They can host the git repository anywhere. Self-host an issue tracking system or find a non-US company that does that (and is not required to follow US sanctions due to trade agreements, that'll be hard).
It's an annoyance, for sure.
> (and is not required to follow US sanctions due to trade agreements, that'll be hard).
I really don't know much about sanctions against Syria and Crimea, but Iranian developers could use every country that hasn't withdrawn from the Iran deal: EU, UK (separate signature, regardless of Brexit), Russia, China.
Or peer to peer cash/crypto swap might be required.
Or businesses themselves sell some of their services with crypto.
It's not like the sanctions were actually dropped even though they were supposed to. That was the whole point of the critiques of the JCPOA.
Re: countries that have withdrawn from the Iran deal. Even those who haven't (AFAIK, Brazil) are still in grey waters because local companies with business in the US are afraid to do business with Iranian companies. For example, two ships weren't allowed to be refilled in Brazil for 50 days while a legal battle at the supreme court was ongoing to decide if the Brazilian oil company could even refill them, because it was afraid to be sanctioned by the US govt (while doing business in the US or with US companies in the future).