Stricter Branch Protections in GitHub Enterprise Server 2.20

GitHub Enterprise Server 2.20 is out, bringing a new set of security-focused features alongside the usual round of performance improvements and bug fixes. The release adds more granular branch protection controls, a personal audit log, and the long-awaited arrival of internal repository visibility to the self-hosted platform.

Repository administrators can now combine branch protection rules to reject pushes containing merge commits, which enforces a linear commit history on protected branches. They can also allow any user with push access to force-push to, or delete, protected branches.

A Personal Audit Log

Enterprise users now have their own audit trail. A Security Log tab has been added to personal settings pages, giving individual users visibility into actions tied to their account.

Internal Repository Visibility Comes to Enterprise Server

Internal repository visibility, previously launched on GitHub Enterprise Cloud in May 2019, is now available in GitHub Enterprise Server. The feature is designed to support innersource practices by letting you share code within an organization while keeping it hidden from outside collaborators.

For this release, administrators can run an optional migration script to convert existing public repositories into internal ones. The migration is optional to allow testing on a non-production instance first, but it will become mandatory in a future release.

When the migration is run on an instance in private mode, the following changes occur:

  • All organization-owned public repositories become internal repositories
  • All user-owned public repositories become private
  • Public forks become private forks, while preserving the fork network
  • The creation of new public repositories is disabled (though it can be re-enabled later)

Where Repository Visibility Is Headed

GitHub is working toward consistent visibility semantics across its entire platform. The goal is for public, internal, and private to mean the same thing whether you are on GitHub Enterprise Server or on GitHub.com, with public repositories ultimately reserved for open source projects shared with everyone.

Internal repositories remain visible only to enterprise members, whereas private repositories are restricted to assigned users and teams. The optional migration script in this release gives administrators time to adapt workflows before the change becomes mandatory.

Deprecations and Other Changes

GitHub Enterprise Server 2.20 also removes support for adding new SSH-DSS keys and for basic password-based HTTP authentication. Personal access tokens remain available as an alternative for authentication. Legacy Gravatar service support has also been deprecated.

Administrators gain the ability to set maxobjectsize to cap the size of commits pushed to a repository, and organization owners can now define default label sets for new repositories. Full details are in the release notes.