There are collision attacks against it but GitHub should be detecting and protecting against those. See https://github.blog/2017-03-20-sha-1-collision-detection-on-...