GitHub Enterprise Server 3.12: Security Controls and Automation Take Center Stage
GitHub Enterprise Server 3.12 is now generally available, bringing a mix of new security capabilities and workflow enhancements aimed at giving enterprises greater control over their software delivery processes. The release focuses heavily on scaling security strategies through automation and expanding the platform's governance features.
Deployment Governance for Actions
Tag pattern restrictions on protected environments
Organizations can now specify which tags or tag patterns are allowed to deploy to protected environments in GitHub Actions. This general availability feature adds a deployment protection rule that lets you configure, for example, only Releases/* tags to target a production environment. It gives teams an additional layer of security by preventing unintended or unauthorized code from reaching critical deployment targets.
Organization-wide required workflows via rulesets
Repository rulesets now support required workflows at the organization level, which is generally available. This lets teams enforce standard CI/CD practices across multiple repositories without per-repository configuration. Existing users of the legacy required workflows feature will find their workflows automatically migrated to rulesets, simplifying the path to ensuring code is secure and compliant before reaching production.
Merge Queue Arrives for Enterprise Deployments
GitHub's merge queue is now available in GHES, bringing automated branch management to enterprise collaboration. The merge queue automatically validates pull requests against the latest version of the target branch, orchestrates merging to ensure the branch is never left in a broken state, and reduces the time developers spend waiting on merges. This aims to keep teams focused on coding rather than branch coordination.
Scaling Security with Advanced Security Features
Dependabot-alert rules for automated triage
With the public beta of user-defined alert rules for Dependabot, customers can now configure how the system responds to alerts without manual intervention. The rules engine supports auto-dismissing or reopening alerts based on customizable criteria, so teams can tune their alert triage to match their specific risk tolerance. GitHub also provides suggested rule presets, including automatically filtering false positives for public repositories and offering suggestions for private ones.
Code scanning default setup expands language coverage
Code scanning's default setup now automatically attempts to analyze all CodeQL-supported languages within a repository. There is no longer a need to manually select compiled languages for inclusion. The configuration page shows which languages are covered, and customization can still be applied at both the repository and organization levels.
Secret scanning detects non-provider patterns
A public beta of secret scanning extends detection beyond known provider patterns to include critical exposure types such as HTTP authentication headers, database connection strings, and private keys. Enabling the Scan for non-provider patterns option in repository or organization security settings adds these detections; findings are organized under a new "Other" tab in the alert list for easier management.
Productivity Updates
Markdown alerts for emphasis
A new Markdown extension provides five distinct styling levels—note, tip, important, warning, and caution—for highlighting significant content in files. This makes it possible to visually signal that certain information carries different meaning or urgency in documentation and notes.
Simplified navigation and project templates
The global navigation has been redesigned with improved wayfinding through breadcrumbs and quicker access to repositories from any location, with enhancements targeting accessibility and performance.
Organization-level project templates are now generally available, allowing teams to create, share, and reuse templates to standardize how they plan and track work.
For full details, see the release notes or download GHES 3.12 from the enterprise releases page.
