Or instead of inventing complicated layered ML models Github could just use each repo's license information to decide what's okay to use. Detecting licenses is already a feature on that site.