GitHub Enterprise setup skill

Plan before
you change GitHub.

Tell Copilot what your enterprise needs. The skill checks GitHub, recommends changes, and saves a plan for you to review.

Install and start → Check the scope

Set up or align an enterprise

Use the skill for coordinated changes across an existing GitHub Enterprise Cloud account on github.com or your enterprise's ghe.com host.

Describe the outcome in your own words. For example, align organization governance, set up teams and repository access, or roll out Copilot. The skill narrows the work to that outcome.

  • Organization and access: plan landing zones, identity requirements, and team access.
  • Repositories and delivery: plan repository factories, rulesets, and Actions policies.
  • Security and Copilot: assess rollout needs, settings, and licensing effects.
  • Governance: trace effective policy to its source and track work that needs another owner.

One prompt starts the guided workflow. Plan includes read-only discovery and prioritized recommendations. The agent asks only for unresolved decisions, one at a time.

Required read-only inventories within your requested scope do not need another skill-level approval. Copilot's tool permissions and your organization's policies still apply.

How the skill works

A control-room view of enterprise setup

The work stays tied to one outcome. Discovery gathers evidence, planning turns it into reviewable changes, and Apply waits for approval.

GOV

Governance and identity

Enterprise policies, organization boundaries, ownership, audit access, and identity handoffs.

  • Enterprise or organization baseline
  • EMU, SAML, SCIM, and IdP boundaries
ACC

Teams and repository access

Team structure, inherited permissions, outside collaborators, and repository roles.

  • Team-first access design
  • Effective access checks
PLT

Repository and Actions platform

Repository factories, rulesets, workflow policy, runners, environments, and cloud trust handoffs.

  • Standards and protected defaults
  • Actions policy and runner model
SEC

Security and Copilot rollout

Code security coverage, rollout waves, Copilot seats and controls, licensing, and verification evidence.

  • CodeQL and secret protection
  • Scoped Copilot rollout
Start with an outcome

Prompts you can send as-is

Replace the values in angle brackets. Each prompt keeps the first pass read-only and saves a plan before it asks to change GitHub.

Establish a governance baseline

Use the github-enterprise-setup skill in Plan mode for enterprise <enterprise> on <host>. Assess governance, identity, Actions, security, and Copilot. Save a reviewed plan without changing GitHub.

Align one organization

Use the github-enterprise-setup skill to align organization <org> in enterprise <enterprise>. Review teams, repository access, rulesets, and Actions policy. Ask one unresolved decision at a time, then save the plan.

Roll out GitHub Copilot

Use the github-enterprise-setup skill to plan a GitHub Copilot rollout for <enterprise or org>. Check seat management, policy inheritance, agent controls, estimated seat changes, and rollout evidence. Do not make changes.

Plan a security rollout

Use the github-enterprise-setup skill to plan code security for organizations <orgs>. Assess entitlements, CodeQL coverage, secret scanning, push protection, exceptions, and rollout waves. Save a plan without changing GitHub.

Before you start

You need GitHub Copilot CLI installed and signed in, GitHub CLI (gh), and jq. Authenticate gh to the intended host with an account that can inspect the selected resources. Changes may require an enterprise or organization owner.

The enterprise account must already exist. The skill checks prerequisites for your outcome. Unsupported APIs and work in an identity provider or another external system become explicit handoffs.

The skill does not administer GitHub Enterprise Server, deploy Azure infrastructure, or run the curriculum's lab provisioners. Use the hands-on sessions to learn a control or test the result with your team.

Preview. Packaging and offline workflow checks are tested. A controlled live setup journey is still required before production use.

A reviewed plan comes before writes

Plan saves the current assessment and proposed changes without changing GitHub. Read the plan, then request Apply when you want to execute it.

Each write batch needs approval. High-impact changes have a separate typed confirmation. The agent also asks before changing authentication. A general "proceed" starts the approval process; it does not approve a batch.

The skill verifies each completed operation and records what remains blocked or unverified. Resume rechecks identity and live state before continuing the known run.

Keep the private run directory outside source control. Legacy Bash wizard runs use a different format; keep them for reference and start a new skill plan.

Read the setup guide →