GitHub Enterprise Server 3.22 Is GA: Air-Gapped Copilot CLI and Required Reviewers Rulesets

What shipped

GitHub Enterprise Server 3.22 is generally available — 28 days after its release candidate shipped on August 11, a tight window for a quarterly self-hosted release. The headline feature is buried in a technical preview label: Copilot CLI now works against GHES in fully disconnected, air-gapped environments, with no connectivity to GitHub Cloud.

What changed

Admins configure a model provider once on the GHES instance and every end user can run Copilot CLI with their GHES credentials against it. That's a structural change, not a feature checkbox: until now, Copilot on self-hosted GitHub required a path to GitHub Cloud's inference. Enterprises that bought GHES precisely because code can't leave the network — defense contractors, banks, healthcare — got no Copilot at all. 3.22 lets them point Copilot at whatever inference endpoint their compliance regime allows.

Also in 3.22: repository rulesets gain a required reviewers rule with file/branch pattern targeting and per-team minimum review counts, working alongside CODEOWNERS — effectively native enforcement of what teams previously bolted on with third-party merge apps. Ruleset bypass lists now accept individual users, so a service account no longer needs a dedicated role just to skip a rule. Enterprise teams are GA, and secret scanning bypass/dismissal requests can be sorted by date.

Why a builder cares

The air-gapped Copilot CLI quietly ends GitHub's strongest lock-in argument for self-hosted customers: "want AI assistance? come to the cloud." If you run GHES because of data sovereignty, evaluate your own model provider options before your compliance team discovers Copilot can now be enabled on your instance without asking. And if you maintain a paid merge-approval app, the required reviewers ruleset rule is GitHub eating your lunch.