From my time working in defense contracting, quite a lot of the software was open source, built on open source components (just like everything else) or even hosted on official military GitHub repos. Code written by the (federal) government itself cannot even be copyrighted (in the US). Obviously you are not going to find the classified stuff on GitHub, but even there it was very common for the government to take all of the source code from one contractor and hand it to another one to work on. You also design your systems so that as much as possible can be unclassified, because unclassified development is much, much easier.