Earlier quoted context omitted.
What I meant was that GitHub's API does not check for the Host header, and the API allows connections from any source. Thus, CORS isn't an issue at all.
But the same-origin policy implemented by your browser should prevent the request before it gets anywhere near the API.
The network tab of developer tools should reveal all of this.