>The Xuantie C906 uses Alibaba-designed cores
That's very confused.
Firstly, the Xuantie C906 *is* a core. The AllWinner D1 (external DRAM) and D1s (DRAM in the package) also sometimes called "Nezha" are chips or SoCs that use the C906 core.
The Sipeed "Lichee RV", the AWOL "D1 EVB" (which many called "Nezha" until we learned that refers to the Soc), the MangoPi "Nezha MQ" and "MQ Pro", the ClockworkPi "Core R-01" (a $29 Pi CM3 compatible board designed for the DevTerm laptop) are variously boards with versions of the D1 chip on them.
Similarly the Xuantie C910 is a (much higher performance) core from Alibaba T-Head, roughly comparable to the A72 in the Pi 4. The C910 is available in the "ICE" SoC, used on the "ICE EVB" (Evaluation Board), which is what the RISC-V Android port has been shown on. I have one, incidentally.
> that are – as required for RISC-V users – available on GitHub.
Incorrect. There is no requirement for RISC-V cores to be put on Github. There are a number of companies with commercially-developed RISC-V cores for which the source code is not available. Alibaba put the C906 and C910 on github entirely voluntarily.