Itaú Unibanco is the largest private sector bank in Brazil and one of the largest financial institutions in Latin America, with a history that spans almost a hundred years. This sort of history is a selling point for companies in the financial services industry, but it can also come with something else that accrues over time: technical debt. For Itaú, many of its software systems were first developed in the early 2000s, and the company followed the standard practices of the time, using a monolithic repository for all its code. 

Therefore, Itaú’s monolithic architecture was holding its developers back from pushing the small changes they needed to make to keep pace with the competition. Itaú realized in early 2021 that they needed to transition to a unified cloud-based architecture DevSecOps tool and become more nimble. The answer was to move to GitHub Enterprise in the cloud, and the 17,000 developers have already seen dramatic results. 

Developers used to open a window for each of a dozen different DevOps tools, which was a big distraction. Now with GitHub, everybody's using the same DevSecOps platform. We provide the same developer experience for everybody in the company, and it has increased our developer productivity.

“Developers used to open a window for each of a dozen different DevOps tools, which was a big distraction. Now with GitHub, everybody's using the same DevSecOps platform,” said Gabriel Galeazzi, a software engineering specialist at Itaú. “We provide the same developer experience for everybody in the company, and it has increased our developer productivity.”

Since moving to GitHub, Itaú has seen its deployment times drop from over an hour to less than ten minutes. And with GitHub Enterprise hosted in the cloud, the company has freed up employee resources to build business-value applications rather than maintaining servers or disparate tools for each part of its DevSecOps approach. This has not only optimized Itaú’s operations, but it has also provided a sense of security. 

“GitHub Enterprise in the cloud takes care of the back end for us, so we don’t have to worry about it,” said Galeazzi. “We just push the code, run the Action, and know that it’s going to work.” 

Itaú has also saved valuable time with its adoption of GitHub Copilot, the AI-powered pair programmer. With GitHub Copilot, Galeazzi says his team spends much less time writing code for simple functions and boilerplate, and even uses it to write infrastructure-as-code to provision the infrastructure they need.

“I urge our developers to use GitHub Copilot as soon as possible, and for as much as they can, because it really lets you do things faster on a daily basis,” he says. “It’s a fact.“

With GitHub Copilot, developers can focus on developing business code instead of writing glue code. They love it. Our developer happiness has improved a lot ever since we adopted it.

Galeazzi says this extra time adds up to benefits for the business and developers alike. “With GitHub Copilot, developers can focus on developing business code instead of writing glue code,” he says. “They love it. Our developer happiness has improved a lot ever since we adopted it.”

Moving to GitHub has also sped up onboarding new developers, said Galeazzi. “We used to have a special onboarding to teach new developer hires how to use GitLab, but nearly everyone already knows how to use GitHub,” he said. Beyond onboarding, Galeazzi also points to GitHub Enterprise’s admin rights and access controls as much easier to navigate than GitLab.

GitHub’s popularity also means that third-party tooling providers often prioritize building integrations for GitHub. Galeazzi pointed to GitHub Actions for ServiceNow and OpenID Connect as two of several pre-built integrations available in GitHub Marketplace that simplified their adoption of GitHub.

For example, Itaú uses StackSpot, a solution created by the company in partnership with its technology subsidiary Zup Innovation, to accelerate application, API, infrastructure and workflow standardization, enabling FinOps and a better developer experience. "By integrating GitHub Actions and StackSpot, we had the ability to share the best stacks we have with the whole company, increasing our reuse by 75% and our deployment reliability by 60%, as StackSpot plugins enable multiple deployments strategies, such as Blue/Green, Canary, and more", said Galeazzi.

“We have a lot of services and technologies that we need to integrate with our development platform, and GitHub has everything you need. You just install an Action and get everything done in an hour or two, which is much, much faster than before. No other platform offers this variety of integrations—It’s fantastic”, he concludes.

Itaú has used GitHub Actions to create automations and reusable workflows in its development process, reducing the time it takes to commit code from more than 15 minutes to less than three. When developers commit to a feature branch, for example, GitHub Actions automates the creation of pull requests to ensure consistency. 

Already, Itaú has found ways to use GitHub Actions to increase its agility. For example, it now performs GitOps with GitHub Actions, automating deployments with a blue-green deployment strategy to a Kubernetes cluster. This means they can test new features and only impact 1-5% of their customers. And on the back end, Itaú relies on GitHub-hosted runners to execute large jobs in its GitHub Actions workflows, again removing the burden of maintenance and offering peace of mind. 

Galeazzi said that they also use GitHub Actions to improve security, by combining Actions with Dependabot to prevent developers from merging pull requests into production until all required security scans are complete. 

“Dependabot is saving us a significant amount of time ensuring our dependencies are up to date,” said Galeazzi. “We used to spend so much time updating dependencies, and now Dependabot automatically opens pull requests for us, and our developers just need to approve them.”

Moving to GitHub helped Itaú to renew its competitive edge, said Galeazzi. With a single DevSecOps platform to unify its tooling, and the ability to modernize its software architecture, Itaú’s developers no longer waste time waiting for small changes to merge into a monolith or inefficiently switching between tooling. Instead, they can focus on building the next great feature.

GitHub was key in our DevSecOps journey. Now we have more developer velocity to deliver our applications faster and meet our customers’ needs.

“GitHub was key in our DevSecOps journey,” said Galeazzi. “Now we have more developer velocity to deliver our applications faster and meet our customers’ needs.”