I think this is just a standard API access prompt. The GitHub Next page clearly indicates it is (C) GitHub Inc and the blog post makes GitHub's control clear.
This is not clear at all. Phishing websites always say (C) Bank of America. That doesn't make it legit.