How safe it is that a single San Francisco company controls the canonical location of Bitcoin code?
You should learn more about the way the git scm system works. First, it is distributed so that everyone has a complete copy of the entire codebase; second, every commit is checksummed, so that if github wanted to (or was forced to) underhandedly change code, it would be detected by everyone.