I've done a little research into this. I found the following (free) self-hosted alternatives to GitHub.

• GitLab CE (demo)
• Gitblit (demo)
• RhodeCode (demo)
• Gogs (demo)
• Gitea (demo; this is a fork of Gogs)

https://qubes-os.org/faq/#what-does-it-mean-to-distrust-the-infrastructure

What does it mean to “distrust the infrastructure”?

A core tenet of the Qubes philosophy is “distrust the infrastructure,” where “the infrastructure” refers to things like hosting providers, CDNs, DNS services, package repositories, email servers, PGP keyservers, etc. As a project, we focus on securing endpoints instead of attempting to secure “the middle” (i.e., the infrastructure), since one of our primary goals is to free users from being forced to entrust their security to unknown third parties. Instead, our aim is for users to be required to trust as few entities as possible (ideally, only themselves and any known persons whom they voluntarily decide to trust).

Users can never fully control all the infrastructure they rely upon, and they can never fully trust all the entities who do control it. Therefore, we believe the best solution is not to attempt to make the infrastructure trustworthy, but instead to concentrate on solutions that obviate the need to do so. We believe that many attempts to make the infrastructure appear trustworthy actually provide only the illusion of security and are ultimately a disservice to real users. Since we don’t want to encourage or endorse this, we make our distrust of the infrastructure explicit.

https://qubes-os.org/faq/#why-do-you-use-github

Why do you use GitHub?

Three main reasons:

1. We distrust the infrastructure, including GitHub (though there are aspects we’re still working on).
2. It’s free (as in beer). We’d have to spend either time or money to implement a solution ourselves or pay someone to do so, and we can’t spare either one right now.
3. It has low admin/overhead requirements, which is very important, given how little time we have to spare.