GitHub Enterprise Server 3.5: Security and Automation at the Forefront

GitHub Enterprise Server 3.5 is now generally available, bringing more than 60 new features with a strong focus on GitHub Advanced Security capabilities. The release includes major additions to package management, dependency security, and CI/CD workflows.

Container Registry and Dependabot

GitHub Container Registry (public beta): Self-hosted customers can now enable the container registry from the management console. Key capabilities include:

  • Fine-grained permissions control for container access at the organization level
  • "Internal" visibility settings for organization containers, in addition to "Private" and "Public"
  • Organization-level data sharing to reduce bandwidth and storage needs
  • Integration with Actions workflows via GITHUB_TOKEN for secure access
  • Anonymous access to public containers without credentials
  • Support for Open Container Initiative (OCI) images

Dependabot (generally available): All three Dependabot services are now available to Enterprise Server customers. Dependabot alerts notify you when vulnerabilities are detected in dependencies. Dependabot security updates automatically open pull requests that upgrade dependencies to patched versions when vulnerabilities are found. Dependabot version updates keep all dependencies current by opening pull requests for newer versions, reducing vulnerability exposure and preventing outdated dependency issues.

Setup requires enabling both Dependabot and the dependency graph for your enterprise.

Actions Enhancements

Reusable workflows are now generally available, letting teams centralize workflow management by referencing existing workflows with a single line of configuration instead of copying definitions across repositories.

Cache support for intermediate outputs and dependencies is also generally available, providing faster job execution.

Administrators can now restrict self-hosted runner groups to specific workflow files and versions, adding another layer of control beyond repository-level restrictions. Combining this with reusable workflows allows organizations to enforce more secure standard workflows.

Self-hosted runners can now opt out of automatic software updates with the --disableupdate flag, giving operators full control over when runner software is updated. This is particularly useful for containerized runner deployments.

Enterprise Administration

Maintenance mode now supports an IP allow list, enabling administrators to restrict appliance access to specific IP addresses during maintenance. This helps keep the instance healthy and unavailable to unauthorized users while operational changes are applied.

Server statistics provide 41 enterprise-specific metrics covering platform usage patterns, offering insights into how teams operate and how the product is being used. This data helps organizations maximize their GitHub Enterprise Server investment.

Three new audit log events—git.clone, git.fetch, and git.push—now capture git activity alongside existing events. These additions are searchable via the UI, exportable as JSON or CSV, and accessible through the API and streaming. This provides fuller visibility into both UI and CLI activity, supporting administration, compliance, and security response requirements.

GitHub Advanced Security Updates

Secret scanning push protection is now in public beta. This feature blocks pushes containing highly identifiable secrets with a false positive rate of less than 1%. Developers can remove flagged secrets or bypass the block when necessary.

The security overview is now generally available at the organization level and in public beta at the enterprise level. It aggregates results from secret scanning, Dependabot, and code scanning into both repository-centric and alert-centric views for quantifying security risk.

Secret scanning dry runs are now in public beta for both organizations and repositories. Administrators can preview custom patterns before publishing them, avoiding the risk of generating thousands of false results from poorly authored patterns.

CodeQL has been updated with support for new languages, improved detection for numerous CWEs, and performance optimizations.