GitHub Enterprise Server 3.22: Copilot CLI for Air-Gapped Environments and More
GitHub Enterprise Server 3.22 RC adds Copilot CLI for air-gapped setups, GA Enterprise Teams, ruleset bypasses by user, and release badges in issue sidebars.
GitHub has published the release candidate for GitHub Enterprise Server 3.22, bringing seven notable changes to self-hosted enterprise installations. The headline addition is Copilot CLI support for air-gapped environments, where no connectivity to GitHub Cloud is available. The release also promotes Enterprise Teams from public preview to general availability, tightens ruleset bypass controls, and adds small but practical UI improvements to pull request and issue views.
What happened
| Feature | Status |
|---|---|
| Copilot CLI for air-gapped / disconnected environments | Technical preview |
| Enterprise Teams | Generally available (was public preview) |
| Ruleset bypass by individual user | Generally available |
| Required reviewers rule in repository rulesets | Generally available |
| Secret scanning request sorting by date | Generally available |
| Release status badge in issue sidebar | Generally available |
| Contributor role labels in PR list view | Generally available |
Feature breakdown
Copilot CLI in air-gapped environments
Enterprises that operate fully disconnected from the public internet can now configure Copilot CLI directly on their GHES instance. An administrator sets up a model provider once, and all users authenticate with their existing GHES credentials. No GitHub Cloud connection is required. GitHub marks this as a technical preview, meaning the API or configuration steps could still change before the stable release.
Enterprise Teams reaches general availability
Enterprise Teams lets owners manage user access across every organisation and repository in an enterprise from one central team structure, rather than repeating that work org by org. GitHub says this reduces the operational overhead of managing permissions at scale. The feature was previously in public preview.
Finer control over ruleset bypasses
Repository rulesets previously required a dedicated role or team to grant bypass permissions. GHES 3.22 adds bypass by individual user, so you can add a service account to a bypass list without creating extra overhead around it. The required reviewers rule is also new: administrators can target specific branches, files, or folders using pattern matching and set a minimum review count per team. GitHub gives the example of requiring a data platform team review on all *.sql file changes, or a security team sign-off on the default branch.
Secret scanning improvements
Security analysts can now sort push protection bypass requests and alert dismissal requests by date, in ascending or descending order, at the repository, organisation, or enterprise level. Previously the sort order was fixed, which made prioritisation difficult when request volumes were high.
UI changes in issues and pull requests
Two small but useful interface updates ship in 3.22. First, the issue sidebar now shows a “Latest release” or “Pre-release” badge when a linked pull request has been included in a release. This means you can confirm a fix has shipped without leaving the issue view. Second, the pull request list for public repositories now displays contributor role labels (“First-time contributor”, “Contributor”, “Member”) next to each author’s name, giving maintainers quick context on who submitted each PR.
Why it matters
The Copilot CLI addition is the most significant change for regulated industries. Defence contractors, financial institutions, and government agencies that run GHES precisely because they cannot send data to the cloud have had no path to Copilot tooling until now. Even in technical preview, this opens a testing window for those teams.
Enterprise Teams GA matters to any organisation managing dozens of repos across multiple GitHub organisations. Centralised access management cuts the kind of manual, repetitive permissions work that causes both security gaps and developer frustration. Paired with the new individual-user ruleset bypass, it gives admins more precise tools without forcing them to build elaborate role hierarchies.
If your team works on web development projects that go through GitHub for code review, the required reviewers ruleset is worth a close look. Pattern-matched review requirements on specific file types or folders are a cleaner alternative to CODEOWNERS alone, especially when non-engineering teams (security, QA, design) need sign-off rights on targeted changes.
Our take
Most of 3.22 is infrastructure polish rather than headline innovation, but that is not a criticism. The required reviewers ruleset rule solves a genuine pain point: getting security or design review on specific file types without a fragile CODEOWNERS workaround. The Copilot CLI air-gap support is promising but ships as a technical preview, so we would not build a workflow dependency on it yet.
The release status badge in the issue sidebar is the kind of small change that saves a lot of tab-switching for teams that do high-velocity releases. It is the sort of detail that is easy to miss in release notes but ends up being used every day.
For teams evaluating AI coding tools in controlled environments, this release candidate period is the right moment to test the Copilot CLI configuration before the stable release locks in the API surface. You can follow our coverage of AI and developer tooling news as the stable release date gets closer.
What to do about it
- Download the GHES 3.22 release candidate from the GitHub changelog page and stand it up in a non-production environment.
- If you run air-gapped infrastructure, configure a model provider and test Copilot CLI with your GHES credentials before the technical preview evolves.
- Review your current repository rulesets and identify any cases where a team or role was created solely for bypass permissions. Replace those with individual-user bypasses where appropriate.
- Enable the required reviewers rule on repositories with sensitive file types (SQL migrations, infra configs, design assets) and validate that pattern matching covers your intended paths.
- Send feedback to GitHub support during the RC period. This is the window where configuration details can still change.
The stable release of GHES 3.22 is not yet dated, so run the RC in staging now and avoid a rushed evaluation when it drops.
Frequently asked questions
What is new in GitHub Enterprise Server 3.22?
GHES 3.22 adds Copilot CLI support for air-gapped environments (technical preview), promotes Enterprise Teams to general availability, allows ruleset bypasses by individual users, introduces a required reviewers rule with pattern matching, enables date sorting for secret scanning requests, and adds release status badges to the issue sidebar.
Can Copilot CLI work without internet access in GitHub Enterprise Server?
Yes, starting with GHES 3.22 (in technical preview). An administrator configures a model provider once on the GHES instance, and users can then run Copilot CLI using their GHES credentials with no connection to GitHub Cloud required.
What is Enterprise Teams in GitHub Enterprise Server?
Enterprise Teams is a feature that lets enterprise owners manage users and their access across all organisations and repositories from a single centralised team structure. It became generally available in GHES 3.22, having previously been in public preview.
How do required reviewers in GitHub repository rulesets work?
Administrators add a required reviewers rule to a repository ruleset and use pattern matching to target specific branches, files, or folders. They can set a minimum number of required reviews per team. The rule works alongside CODEOWNERS and is useful when teams like security or QA need sign-off on specific types of changes.
