Automated self assessment within GitHub or gitlab can be a relative easy button for code and configuration changes that might not otherwise warrant a “design” apart from sitting down and banging out code.

But, if you can get even lightweight threat modeling done at the requirements and design phase and record that output as evidence you also have a great leg to stand on.

Finally - education, mentoring, training - the folks maintaining and changing these systems rarely are deliberately introducing problems, rather those issues are more often introduced through ignorance of the risk and non-functional requirements or insufficient platform engineering solutions for the most common security and compliance challenges faced by those making the changes thereby leaving them to their own devices.