Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?
Note : not a QSA, but I do have some PCI experience.
There is nothing in PCI about storage of source code [mod note: this was true pre-version 4.0]. There are requirements about change management, which github would help with, but nothing about where source code should be or any requirements to keep source code private (it allows use of open source, after all). Given a private repo and assuming you do not store authentication information (keys, appids, passwords, api keys, certificates), PCI governed data or PII in GitHub repositories (which you shouldn't be doing anyways), you are probably fine using GitHub. Talk to your QSA if you want to be sure.