How California Department of Technology uses GitHub

The California Department of Technology (CDT) oversees infrastructure that provides vital services to millions of people across the US' most populated state. With over 140 different departments and 200,000 employees, CDT keeps state departments current on technology while ensuring over 39 million residents can access public health and emergency services information.

The Challenge

CDT's Office of Enterprise Technology (OET) is responsible for providing statewide web, geospatial, and data services while navigating government regulations. Every moment counts in an emergency or national disaster—including how many seconds it takes for a website to load.

For years, the department operated with on-premises infrastructure that couldn't support rapid software development and delivery. Code and scripts were stored in data centers or even in folders on individual PCs. Developers built code on their desktops and manually copied it to servers, opening their work up to critical vulnerabilities. Manual maintenance consumed valuable time, and the lack of security was unsustainable for a department responsible for public health and safety services.

The Solution

CDT built on their existing Microsoft Azure DevOps infrastructure and selected GitHub to modernize their development process. They started by hosting code on-premises using GitHub Enterprise Server, which allowed developers to commit code and see changes deployed to websites within minutes—a dramatic improvement over their previous timeline.

As the department adopted an agile framework, they switched to GitHub Enterprise Cloud to accelerate collaboration both within CDT and across state departments. "Within our department, collaboration is easy, because we all have access to Azure DevOps," explained Skreakar Peddi, Cloud Security and Infrastructure Solution Architect. "But now when we need to collaborate between departments, we give access to our GitHub repositories to collaborate and get caught up in the content."

DevSecOps Integration

By combining GitHub and Azure DevOps, CDT extended DevOps to DevSecOps, making security a shared responsibility built directly into the developer workflow. Before developers commit code, it's pre-scanned and shown as a "pre-commit." After code is committed, it triggers their CI pipeline, funneling code through Veracode—CDT's static scan analysis tool—and SCAs. Developers can immediately assess any reported code vulnerabilities.

"The goal here is to fail fast," said Shamal Siwan, Lead DevOps Engineer/Solutions Architect. "You fail fast, you fix it, and you move forward, because guess what? It takes you a minute to solve that security issue in development when it could potentially take you hours or days to fix in production."

Real-World Impact

CDT's digital transformation proved its value during California wildfire season. When high winds prompted PG&E to shut down power to avoid potential sparks, CDT jumped into action. Working across departments, their developers built and deployed online resources in less than 24 hours to help residents find emergency assistance.

"We reduced our deployment time significantly," Siwan said. "To deliver quickly, using GitHub and Azure DevOps for our DevSecOps process, CI/CD, infrastructure, code, and automation was the key."

Deputy Chief Technology Innovation Officer Manveer Bola noted that the department's technical delivery and stability during the blackout was unprecedented. "A lot of people were surprised how—unlike traditionally—the government was able to perform better than a private entity in keeping these websites up and resilient with all the demands. The government actually delivered a much more stable solution much more quickly than a private entity could."

Looking Forward

CDT's transformation has set a precedent for rapid development and deployment across California government. Chief Technology Innovation Officer Scott Gregory emphasized the broader impact: "It's begun to set a precedent that this organization is able to turn out code, applications, and websites in a fraction of the amount of time that traditionally it was done in the past. We've been able to build partnerships not only with industry but also internally with government partners to convince them that this is the future."