I've been dumbfounded that GH hasn't invested in the space. There's tons of obvious surface area still available for automation.
A one-off project of mine tries to improve supply-chain license management for projects [1]. I got bit once by an MIT licensed project that accidentally took a GPL dependency a couple versions later. That was a pain to notice without analyzing transitive dependencies. Never again.