How Carlsberg Group uses GitHub

Carlsberg unified its development process and bolstered security using GitHub Enterprise, GitHub Advanced Security, and GitHub Copilot to accelerate innovation and eliminate context-switching across its engineering teams.

Key Results

• 600 secrets detected and removed from source code with GitHub Secret Scanning
• 30,000+ security vulnerabilities removed since activating GitHub Advanced Security
• 6 tools consolidated into a single platform for software development

Watch: Crafting excellence: Carlsberg's tech transformation with GitHub

About Carlsberg's Implementation

Seats: 200
Location: Copenhagen, Denmark
Industry: Food & Beverage

The Challenge

Carlsberg's development processes were fragmented across multiple tools, forcing developers to context-switch frequently and act as DevOps engineers just to build and publish code. This heterogeneous landscape also created security vulnerabilities, with undetected secrets embedded in source code—often a symptom of developers taking quick fixes under pressure.

Unifying Development on GitHub Enterprise

Carlsberg's first step was consolidating its developer organization around GitHub Enterprise. "When I came onboard we were dealing with a heterogeneous development landscape, where everyone had to be a DevOps engineer to get anything built or published," says Peter Birkholm-Buch, Head of Software Engineering. Centralizing on GitHub Enterprise reduced their toolchain from 6 tools to a single platform, allowing engineers to focus on coding rather than process management.

The company transitioned to a platform engineering model with a central team that eliminated friction for developers. "Everything from standing up infrastructure on Azure to managing code—it all lives on GitHub," Birkholm-Buch explains.

Accelerating Development with GitHub Copilot

The implementation of GitHub Enterprise created the foundation for integrating advanced tools like GitHub Copilot. The AI coding assistant provides valuable suggestions directly within the IDE, removing development roadblocks and enhancing productivity.

The response from Carlsberg's developers was immediate and enthusiastic. "Everyone immediately enabled it, the reaction was overwhelmingly positive," Birkholm-Buch shares. Copilot has become nearly universal across the team, with developers reluctant to work without it.

Beyond productivity, Copilot proved to be a valuable learning tool. "I experienced my Eureka moment with GitHub Copilot when I realized it significantly reduces the learning curve required to become an efficient cloud developer," Birkholm-Buch notes. "It's much easier for developers to jump onto new languages and platforms, because GitHub Copilot will hold your hand and guide you."

Strengthening Security with GitHub Advanced Security

To enhance developer efficiency and strengthen security, Carlsberg adopted GitHub Advanced Security (GHAS). The impact was immediate: Secret Scanning revealed approximately 600 unknown secrets within their source code—a direct result of the previous fragmented tooling that forced context-switching.

"Secrets in source code are often a sign of forced context-switching, leading developers to quick fixes such as embedding passwords in code," Birkholm-Buch explains. Centralizing development on GitHub addressed this on multiple fronts. The single platform eliminated the need for context-switching, while Secret Scanning and Push Protection ensured a clean, vulnerability-free codebase.

Carlsberg implemented auto-merging of pull requests in most repositories and automated security workflows within CI to conduct comprehensive checks against container images and code. This integration of GitHub Actions and GHAS enhanced collaboration between developers and the security team, increasing awareness of potential threats on both sides.

The results speak for themselves: Carlsberg now maintains zero known secrets within their code repositories in Software Engineering.

Streamlining CI/CD with GitHub Actions

Carlsberg revolutionized its workflow by consolidating previously disjointed Jenkins CI/CD pipelines into GitHub Actions. This harmonization allowed all teams to leverage the same pipeline regardless of tech stack or deployment targets, with minimal configuration.

Once a pull request receives approval, the automated process streamlines testing and infrastructure updates, enabling expedited deployment and a microservices approach that enhances product agility.

The transition also democratized contribution to these pipelines. Unlike the previous system where only a select few engineers understood the intricacies, GitHub Actions enabled broader participation. "We now see other teams contributing to these pipelines and workflows," says João Cerqueira, one of Carlsberg's engineers. "That never would have happened before." This shift fostered a culture of innersourcing, where cross-team collaboration and contributions are expected.

The Impact

By leveraging GitHub's platform, Carlsberg transformed its development environment to accelerate innovation while ensuring security. The company eliminated context-switching, simplified CI/CD pipelines, and accelerated development with Copilot—giving developers more time to tackle complex problems.

"GitHub helps us eliminate context switching and keeps developers in the zone," Birkholm-Buch concludes. "That translates into developers being more efficient and writing code faster."