GitHub Enterprise Server 3.9 arrives with roadmap views, code scanning defaults, and better observability
GitHub Enterprise Server (GHES) 3.9 is now generally available. The release concentrates on four areas: richer project planning capabilities, streamlined security tooling, deeper visibility for administrators, and a supported path for scaling Actions runners on Kubernetes.
Projects gets a roadmap layout and workflow automations
GitHub Projects on GHES introduces a new roadmap layout, letting teams visualize issues and pull requests on a timeline. This makes it straightforward to share long-term plans and iterate on scheduling directly alongside the code.
Two new built-in workflows reduce manual project upkeep. Auto-add monitors designated repositories and pulls in issues as they are created or when they match a custom rule, such as a specific label or milestone. Auto-archive keeps a project tidy by removing any item that has remained closed beyond a user-defined period.
Teams can also standardize how projects are set up. A new copy function duplicates an existing project—views, custom fields and all—so a winning configuration can be reused instantly. Additionally, issue forms can guide contributors into submitting the right content for different issue scenarios.
Other smaller additions include: sorting on boards and roadmaps, an updated issue create modal, deep links for draft issue URLs, colors and descriptions for single select fields, and new GraphQL endpoints for creating and deleting custom fields in projects.
Security features lower setup friction and catch more leaks
For organizations on GitHub Advanced Security, this release reduces the effort required to stand up both code scanning and secret scanning.
Code scanning with CodeQL has a new default setup option. Administrators can enable it from the Security tab in repository settings in only a few clicks, without hand-editing .yaml files. Default setup supports Python, JavaScript, and Ruby repositories.
Once code scanning is active, the new detailed status page provides visibility into scan health and coverage. It reports on the status and errors for each scan, helping teams pinpoint misconfigurations and resolve failures.
For leak prevention, secret scanning now checks for organization-level and repository-level custom patterns at push time, catching developer-defined sensitive information before it enters the codebase.
In step with guidance from Executive Order 14028, developers can now export a repository’s dependency graph as an SPDX-format software bill of materials (SBOM). The export is available from the dependency graph page or through the API as a JSON file.
Operators gain observability and upgrade tooling
Logs on GHES appliances now follow the OpenTelemetry structured log standard, simplifying parsing and speeding up debugging. GitHub has published a complete mapping table to help administrators understand the format transition.
New tools in ghe-manage add visibility during maintenance operations. ghe-migrations reports the status and duration of migrations during upgrades, while ghe-backup-progress shows progress when generating a backup with backup-utils.
Kubernetes native runner scaling with ARC
Organizations running Actions on GHES can use the Actions Runner Controller (ARC) as a supported way to scale self-hosted runners. ARC is an open source project adopted by GitHub that uses Kubernetes to orchestrate runner sets. A recent addition is auto scaling in response to webhook events, allowing runner infrastructure to grow and shrink based on actual demand.
For the full list of changes, see the release notes. Existing customers can use the Upgrade Assistant to find a suitable path from their current GHES version.
