I thought that "distribution" of a derived work requires the source to be released.
First of all, GitHub is not distributing Git. Secondly, you have to be careful with what you mean by "released". The GPL requires that you make the source code available to only those to whom you distributed the binary. If you distribute the binary to person A, then you only need to make the source code available to person A; not to person B, and certainly not to the whole world.
Also, Git is designed to be highly modular with individual modules having clearly defined interfaces so they can easily be swapped out. Therefore, it would be possible to modify Git's behavior by writing a module that does not create a derived work.
And then there is libgit2, a re-implementation of Git-core in portable C, designed to be embedded into other projects. It is specifically licensed to allow proprietary projects to link against it. According to the libgit2 homepage, GitHub uses libgit2.
According this post, GitHub is running a fork of Git.
That only indicates GitHub is not running an official release. They could be running a development version of the official Git codebase or a patched version that they sent to be integrated into the official Git codebase but hasn't been integrated yet.