Pharma leader creates a unified developer environment

Phase 1: Migration assessment

Goal: Establish a clear migration strategy and scope.

Modus Create’s architects and DevSecOps experts kicked off the project with an assessment to evaluate migration scope and feasibility. They evaluated existing development environments, internal processes, and frameworks and recommended narrowing the scope of the migration.

The team suggested limiting the migration to GitHub repositories and postponing Terraform and cloud migrations to reduce complexity and risk. This approach would prove vital later as it would help minimize resistance to change and finish the migration on time.

Phase 2: Preparing the team

Goal: Ensure a smooth onboarding process for all new developers.

Next, we invited all remaining team members from the acquired biotech firm who did not yet have accounts in the pharma company’s GitHub enterprise. The team worked closely to map permissions for the corresponding accounts to the pharma’s environment, ensuring consistent permissions and retaining the biotech firm's role structures. 

We also resolved duplicate accounts by consolidating contributor accounts with single sign-on and a parallel set of teams. This phase was crucial as it ensured that common challenges associated with user roles and access were resolved before the migration.

Phase 3: Proof of concept and initial migration

Goal: Demonstrate success with a small, low-risk batch.

The project involved moving over 900 repositories. Migrations of such scale always invite concerns from development teams. To mitigate risks and address potential objections, we conducted a pilot migration on a small set of low-risk repositories. This allowed teams to validate processes, test configurations, and ensure workflows would not be disrupted.

This phase provided critical insights that helped refine the bulk migration process, improving efficiency and addressing key concerns from teams that were initially resistant to change.

Phase 4: Bulk and critical repository migration

Goal: Migrate all repositories with minimal disruption.

Once confidence was established through the initial migration, we proceeded with the bulk migration of the remaining repositories. This phase involved:

• Leveraging automation: We adapted a previous project’s GitHub migration scripts to significantly reduce manual effort.
• Ensuring secrets transfer: Instead of copying repositories via the GitHub Enterprise Importer, which wouldn’t preserve secrets, we performed repository transfers wherever possible to maintain GitHub Actions and Secrets integrity.
• White-glove support: We provided real-time troubleshooting and dedicated war-room sessions for high-stakes teams, ensuring they had complete confidence in the process.
• Flexible scheduling: Critical teams were given control over migration timing to avoid major project disruptions.

Phase 5: Post-migration support

Goal: Optimize security, governance, and developer experience.

Following the migration, our team focused on finalizing security measures, governance policies, and operational efficiencies. This included:

• Automated metadata standardization: We created a custom metadata YAML file for all migrated repositories to align them with enterprise security policies.
• Repository cleanup and archiving: Teams were encouraged to retire or archive obsolete repositories to reduce security risks and maintenance burdens.

Security tool integration: We facilitated a transition from a mixture of legacy security tooling to the pharma company’s existing SonarQube and TruffleHog-based secret scanning, aligning all repositories with enterprise security standards.