Comment by bonzini

According to (second-hand) experience with auditors with respect to open source, they were quite open to considering things like CI, good commit messages etc. are useful when evaluating the development process, and even considered them sufficient (with adequate explanation) towards some of the ISO26262 requirements. However, that was for ASIL B only.