GitHub confirms it has blocked developers in Iran, Syria and Crimea

I would have said "move to git.kernel.org" but that's also hosted by a US based provider:

    organisation:   ORG-PHI3-RIPE
    org-name:       Packet Host Inc
    org-type:       OTHER
    address:        30 Vesey Street, Suite 900, New York, NY 10007 US

And, obviously GNOME git servers are US based, since they're owned by RedHat/IBM.

Use a self hosted gogs installation (https://gogs.io/) under your own domain and root server outside US jurisdiction.

Or just use ssh. That’s what I’ve always done with my friends when we didn’t want to use GitHub.

There’s no need to over complicate things.

GitLab is self-hostable as well, although I imagine Gogs is easier.

Gitlab is actually super easy if you keep to the omnibus installation methods or docker image.

The only problem regarding gitlab is resource consumption.

If your company operates in the US and uses a provider, who does not implement sanctions, does it have to enforce them on its own?

I mean, something like selling a product, maybe based on open source tech in the US and cooperating with devs in sanctioned countries via a workaround provider..