How GitHub maintains compliance for open source dependencies — Blankdot