“There's no GitHub, so no pull request, but we're still doing some code review.”

Transcript evidence from François Proulx -- Actionable Software Supply Chain Security.