GitHub Enterprise Server 3.22 brings a set of practical upgrades that affect AI‑assisted development, enterprise identity management, security operations, and pull‑request governance. The release adds a technical‑preview integration for Copilot CLI in air‑gapped GHES installations, graduates enterprise teams to general availability, and expands repository ruleset capabilities with per‑user bypasses, required‑reviewer policies, and richer UI signals.
Copilot CLI in air‑gapped GHES environments
Administrators can now point the Copilot CLI at a GHES instance that runs without internet access. A single model provider is configured once in GHES, after which any user with valid GHES credentials can invoke the CLI. This is a technical preview, so the API surface may evolve. For AI engineers, the change means that code‑completion assistance can be offered inside strictly isolated networks, but the preview status requires validation before production rollout.
Enterprise‑wide team management
Enterprise teams have moved from public preview to general availability. An enterprise owner can create a hierarchical team that spans all organizations and repositories under the enterprise, consolidating user‑access decisions in one place. Cloud and platform engineers can replace ad‑hoc cross‑org permission scripts with this native construct, potentially lowering the risk of permission drift and simplifying audit trails.
Enhanced security and compliance controls
Secret‑scanning workflows gain a sortable view for push‑protection bypass requests and alert‑dismissal requests. The filter bar now accepts ascending or descending date ordering at repository, organization, and enterprise scopes, making it easier to prioritize high‑volume review backlogs. Additionally, repository rulesets can now list individual users for bypass permissions, allowing a service account to be exempted without creating a dedicated role or team. Security analysts can use these knobs to fine‑tune exposure while retaining auditability.
Repository ruleset extensions for code review
Organization owners and repository administrators can attach a required‑reviewers rule to a ruleset. The rule supports pattern matching on branches, files, and folders, and lets you set a minimum number of approvals per team. It works alongside CODEOWNERS, enabling scenarios such as mandatory security review on all *.sql changes or mandatory design sign‑off on feature branches. DevOps and SRE teams can codify cross‑functional gatekeeping without scattering protection logic across multiple tools.
Visibility improvements for developers and maintainers
Issues now surface a badge in the sidebar indicating whether the linked pull request is part of the latest release or a pre‑release, removing the need to navigate away from the issue view. Public repositories also display contributor role labels—First‑time contributor, Contributor, and Member—directly in the pull‑request list. These UI cues help maintainers triage contributions faster and give developers immediate feedback on the release status of their work.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Evaluate the Copilot CLI preview in a staging GHES cluster before extending it to production, and document any required model‑provider configuration steps. Adopt enterprise teams to replace custom scripts that synchronize permissions across orgs, and verify that existing access policies map cleanly to the new hierarchy. Update secret‑scanning dashboards to use the new sort options, and consider per‑user bypass entries for service accounts that need uninterrupted CI pipelines. Finally, revise repository rulesets to include required‑reviewer policies where regulatory or quality gates are needed, and train developers to look for the release badge and contributor labels as part of their daily workflow.
