Beyond the News
Sign in
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI CodingDeployment & DevOpsDeveloper Tools Active dossier

GitHub Enterprise Server 3.22 brings Copilot CLI into disconnected and air-gapped environments

GHES 3.22 can now act as the control point for Copilot CLI in environments with no GitHub Cloud connectivity: administrators configure an approved model provider once, and developers authenticate to the local Enterprise Server with their existing credentials.

Reviewed and published by Lars Jansen Updated 6 min read
Comment
First published

Key details

  1. GitHub Enterprise Server 3.22 became generally available September 8, 2026.
  2. Disconnected/air-gapped Copilot CLI support is a technical preview.
  3. The configuration does not require connectivity to GitHub Cloud.
  4. A GHES administrator configures a model provider once for the server using `ghe-config`.
  5. End users authenticate Copilot CLI to GHES with Enterprise Server credentials and enable `COPILOT_OFFLINE=true`.
  6. GitHub recommends retrieving the GHES token dynamically from authenticated GitHub CLI where practical.
  7. AI-assisted coding, shell commands, file operations and GHES repository operations are supported in the offline architecture.
  8. Features dependent on GitHub Cloud, including GitHub-hosted model selection and web search/fetch, are not generally available in the offline configuration.
  9. Administrators still need a supported LLM provider and appropriate network access to it.

What builders should take away

  1. Map the full inference network path before calling a deployment air-gapped; removing GitHub Cloud does not matter if the configured model provider still requires an unapproved public route.
  2. Keep model-provider credentials centralized at the GHES administration layer rather than distributing them to every developer where the supported architecture allows it.
  3. Use GitHub CLI authentication to retrieve short-lived/current GHES credentials dynamically instead of copying tokens into scripts or shell profiles.
  4. Inventory Copilot features your developers rely on before migration because web search, cloud-hosted model selection and other cloud services will not have equivalent behavior offline.
  5. Treat technical preview as a controlled pilot: test upgrades, provider outages, token expiration and agent command permissions before enabling high-consequence repositories.
  6. Combine the disconnected deployment with repository, shell and sandbox policy; data locality alone does not constrain what an agent can execute.

What changed

GitHub Enterprise Server 3.22 became generally available on September 8, 2026 with a technical-preview capability to run GitHub Copilot CLI in disconnected or air-gapped environments without connectivity to GitHub Cloud. A GHES administrator configures a supported LLM provider on the appliance once using `ghe-config`; end users then point Copilot CLI at the Enterprise Server, enable offline mode and authenticate using GHES credentials. Core AI-assisted coding, shell/file operations and GitHub repository operations through an authenticated `gh` CLI can work in this configuration, while capabilities that require GitHub Cloud—such as GitHub-hosted model selection, web search/fetch and some cloud services—remain unavailable.

Why it matters

The deployment boundary for coding agents is shifting from 'the model may be private' to 'the whole control path can stay inside an enterprise network.' Organizations with regulated, classified or otherwise disconnected software environments have often been unable to adopt cloud-first coding agents even when they could host or contract for an approved model. GHES 3.22 provides a supported architecture where repository identity and operations stay on the local GitHub Enterprise Server and inference goes to an administrator-selected model provider. It is still technical preview, so teams should treat it as an evaluation path rather than a mature production guarantee.

The Enterprise Server becomes the local Copilot control point

An administrator configures the model provider on GHES with administrative SSH access and applies the settings once for the instance. Developers set their GHES host and token, enable Copilot offline mode and launch the normal Copilot CLI. The server-side configuration avoids requiring every developer to independently configure model-provider credentials.

Repository operations stay tied to GHES identity

Copilot CLI users authenticate to the Enterprise Server, and GitHub operations such as reading repositories, creating issues or working with pull requests can run through the `gh` CLI against that GHES host. GitHub recommends dynamically retrieving the GHES token from GitHub CLI rather than copying it into persistent configuration.

Offline does not mean every Copilot feature works locally

GitHub’s documentation distinguishes capabilities that can operate in the disconnected configuration from those that rely on GitHub Cloud. Core prompts, coding assistance, shell/file operations and GHES repository workflows are available, while GitHub-hosted model selection, web search/fetch, cloud telemetry/reporting and other cloud-only services are limited or unavailable.

The model provider is still an external architecture choice

The feature removes the dependency on GitHub Cloud, but it does not automatically imply on-premises inference. Administrators need an API key for a supported model provider, and the network path to that provider must fit the organization’s disconnected architecture. In a genuinely isolated environment that generally means an approved provider reachable from inside the network or another arrangement that does not require public-cloud connectivity.

GA server, preview Copilot feature

GHES 3.22 itself is generally available, but GitHub labels disconnected Copilot CLI support a technical preview subject to change. Enterprises should therefore validate model compatibility, authentication, token handling, network boundaries and upgrade behavior before treating the feature as a durable compliance control.

What to watch next

  • When disconnected Copilot CLI support moves from technical preview to general availability.
  • The supported model-provider list and whether fully self-hosted/open-weight inference becomes a documented first-class path.
  • Enterprise telemetry and audit capabilities that work without GitHub Cloud.
  • Whether Copilot IDE clients gain the same disconnected GHES architecture as the CLI.
  • How GitHub handles model/provider upgrades and compatibility inside long-lived isolated environments.

Still unclear

  • The disconnected Copilot feature is technical preview and GitHub says it is subject to change.
  • The exact security and data-residency properties depend on the configured model provider and network architecture, not GHES alone.
  • The offline configuration intentionally lacks some cloud-dependent Copilot capabilities, so feature parity with GitHub.com should not be assumed.
  • GitHub’s documentation provides a directional support matrix rather than a guarantee that every current Copilot CLI feature behaves identically on GHES.

Sources

Direct reading behind this dossier.

3 sources
Set up and use GitHub Copilot CLI
GitHub Docs primary documentation

Implementation details for model-provider configuration, client environment variables, GHES token handling and supported offline capabilities.

Discussion

Discussion is reader-contributed. Comments are not part of the BTN dossier or its editorial evidence.

0 visible comments

Join the discussion

Keep comments useful and relevant. Reader contributions may be moderated and are not BTN editorial evidence.

Sign in to comment
Continue reading
Artificial Intelligence

GitHub Copilot code review can now approve pull requests

Copilot code review now moves from advisory assessment toward a governed merge gate. The public preview remains off by default, and GitHub’s current docs let administrators separate AI approval itself from whether that approval counts toward required-review policy.