US companies have no legal obligation to comply with a Spanish court order. A MLAT must be arranged and approved before US companies have a legal obligation.

GitHub's compliance with the court order was voluntarily and discretionary; just like how if the North Korea courts told me to shut down my site, you have every right to say no.