GitHub Enterprise Server 3.6 ships with more than 60 new capabilities

GitHub Enterprise Server 3.6 is now generally available, bringing more than 60 new features for developers, security teams, and administrators. The release adds GitHub Discussions, the repository cache, audit log streaming, a Pull Request File Tree view, and Server Statistics. It also extends GitHub Advanced Security with enterprise-level security overviews for all alert types and stronger dependency enforcement controls.

You can download the release directly or use the Upgrade Assistant to map a path from your current version.

A home for ideas next to the code

GitHub Discussions gives teams a dedicated space for developing ideas, working through feature requests, and recording decisions without leaving the repository. The goal is to reduce context switching between code, chat apps, email, and knowledge management systems, while keeping GitHub Issues focused on capturing concrete work and plans.

Screenshot of GitHub Discussions page

Faster pull request reviews and more reliable provenance

The new Pull Request File Tree view helps reviewers navigate large or complex changes. Jumping between files and grasping the scope of a review at a glance becomes much easier.

Screenshot showing a pull request being reviewed

The release also improves historical commit verification: commits are now marked as "verified" even when the author's public GPG signing keys have expired or been revoked, as long as they aren't compromised. Administrators can additionally grant GitHub Apps exceptions to branch protection rules, making it easier to build compliant automation on top of existing policies.

Compliance-ready auditing and transport hardening

Audit log streaming lets security teams send audit events to a dedicated log collection system, using the SIEM tools they already operate. With streaming, there's no risk of losing audit events during investigations. The release also tightens transport defaults: insecure SSH keys and protocols are removed from Git, and TLS encryption can be enforced for incoming SMTP connections, helping instances meet compliance requirements.

Repository cache serves global CI without the slowdown

Large distributed CI farms often put substantial load on a Git server, which can degrade performance for interactive users. The GitHub Enterprise Server Repository Cache, now generally available after a beta launch, gives operators an eventually-consistent replica of Git data with data locality policies. CI runners fetch from nearer replicas, reducing strain on the primary server.

Seeing how your instance actually runs

Server Statistics collects key aggregate metrics across Enterprise Server instances to help administrators anticipate organizational needs and understand team workflows. When enabled, 41 metrics are available through a connected GitHub Enterprise Cloud account via a REST API or as CSV or JSON exports. The data also feeds back to GitHub to inform how the platform evolves.

Advanced Security visibility and controls

GitHub Advanced Security customers get several new capabilities with 3.6. The enterprise-level security overview now includes Dependabot and code scanning alerts in one place, providing a single pane across all codebases.

Screenshot of the security overview page

  • Dependency review enforcement (beta): A new dependency review API and action make it possible to break a build when a vulnerable dependency is introduced, addressing the difficulty of parsing large manifest or lock file changes.
  • Secret scanning dry runs (beta): Enterprise administrators can test custom patterns across the entire enterprise before publishing them and generating alerts, allowing impact assessment and pattern refinement in advance.
  • Code scanning dismissal reasons: Developers dismissing code scanning alerts can now attach a comment explaining their reasoning.

Full details are available in the release notes for GitHub Enterprise Server 3.6.