It really depends upon if the git repo is gpg signed. We really don't know enough about the automation to make any assumptions.
Were I to do it I would require gpg signed commits and setup the trust chain a bit differently. But you're right its likely just a list of git repos that aren't signed.
Signing of the repo contents (commits/tags) doesn't help anyhow with user ssh keys. If the automation gets the keys from github it effectively trusts github completely, irrespective of the situation with repos.
Re:Obtain a GitHub user's public keys
by TheLoneWolfling on Monday June 16, 2014 @12:58PM
(#7900059)
Not necessarily. It could do key pinning for example, which at least protects already-established users.
On the other hand, OP probably trusts the contents of source repositories stored on github (few people use commit and tag signing); if so he already trusts github with everything.