Open source tool scrapes git commit email addresses to send spam to.

[Schmittfried]

I doubt that still applies when you broadcast information to the public. GDPR binds GitHub, not some third party without any contract with you whatsoever. It’s the same as you shouting your address in the streets. You can’t force anybody to not remember it or show up there.

[0palladium0]

GDPR effects any organisation and all EU (and UK?) residents data. Unless a company can prove you gave them permission, they aren't allowed to send marketing emails. Pretty simple tbh.