GitHub Enterprise Server 3.10 adds security and compliance controls
GitHub Enterprise Server 3.10 is now generally available. The release brings enhanced security and compliance controls that give developers and administrators more granular control over repositories, along with improvements to deployment safety, code scanning, and backup operations.
Code scanning is simpler to enable and track
Setting up code scanning across repositories no longer requires writing a .yaml file. With the new default setup experience, developers can enable code scanning on a repository in a few clicks, and teams can apply it across multiple repositories at once. Default setup is not yet available for Swift projects; that support will arrive in a later release.
For central security teams, risk and coverage insights are now included in the enterprise-level code security pages. These allow drill-down by team or organization to direct rollout and remediation efforts. Repository-level triage also gets easier with the ability to filter alerts by file path or language.
CodeQL, the engine behind code scanning, now also supports Swift. Combined with Kotlin support added in Enterprise Server 3.9, CodeQL covers both iOS and Android development languages.
Deployment guardrails and runner governance
Teams using GitHub Actions for continuous deployment get custom deployment protection rules in this release. These rules let teams build guardrails that ensure only deployments passing quality, security, and manual approval checks reach production, complementing existing environment protections such as required team approvals.
Administrators also gain new control over Actions runners. Enterprise admins can now disable repository-level self-hosted runners across organizations and user namespaces, ensuring all jobs run on centrally governed machines and reducing the risk of compromise from untrusted workflow code.
Fine-grained personal access tokens
Classic personal access tokens can carry broad permissions across all accessible repositories, making a leaked token a significant risk. Fine-grained PATs minimize this by offering a set of over 50 granular permissions, each grantable as no access, read, or read and write. These tokens also have expiration dates and only access the repositories or organizations explicitly granted to them, supporting a least-privileged access model.
Branch protection refinements
Two updates to branch protection rules address compliance needs. First, the enforcement of required approvals has changed; second, administrators can prevent the last pusher of a pull request from approving it. Both tighten the approval process for regulated workflows.
Projects and additional highlights
GitHub Projects is now generally available on Enterprise Server. Project tables provide a spreadsheet-like live workspace for filtering, sorting, and grouping issues and pull requests, giving administrators visibility across activity while keeping developers in flow.
Before GitHub Projects, I would have needed two or more tools to get context from interdisciplinary teams on their projects. Now I can get context at a glance all in one place, so teams can be efficient and stay in the flow.
Faster backups and upgrades
Operational improvements target backup and upgrade workflows. Updates to ghe-migrations now show the status of all database migrations during an upgrade. Backup-utils v3.10.0 supports incremental MySQL backups and lets administrators prune backup snapshots outside of the backup generation process, speeding up backup cycles.
Download GitHub Enterprise Server 3.10 from the release page. Use the Upgrade Assistant to determine your upgrade path from a current version.
