Is Github on the hook if the client is actually a resident? If so, the law is still bad and github's response may be appropriate(just blocking login from Iran sounds better though). You can't expect them to investigate the personal details of their users.