That depends on what personal data they're collecting and for what purpose, in the case that a person hasn't explicitly opted-in by giving consent freely. I don't think it's possible for us to figure those details out exhaustively merely by observation from the outside.
Yes, and it's not like the EU is going to send surprise inspections to go dig into Microsoft's code and databases to check whether they are violating this or not?
They don't send surprise inspections to your house to check if you're engaging in criminal activity, either.
My point is that you're moving the goalposts. Law enforcement generally always requires a complaint that justifies an investigation, and people and organisations get away with breaking the law all the time. However that has nothing to do with whether or not GitHub put their website behind a "consent" wall, or whether or not they're doing in-house as opposed to contracted-out analytics.
