> GHE has its own product roadmap that is quite a bit behind the cloud product

This is exactly what we want though. We don't need the new fancy shit on a regular cadence. Issues, Code, PRs and 1 line checkbuild scripts are all we care about. Everything else is built into our software.

What I mean is that it's quite clearly not the same product as cloud. It does have roughly the same road map as cloud, just pretty far behind and/or cherry-picking some features in a different order. My experience with enterprise software is that it doesn't matter what the roadmap is as long as you get to choose if/when the benefits outweigh the risks for an update. And you usually want certain releases to get backported security updates for that same reason. You don't have to take new features and their associated bugs but you do want, and get, security fixes. That's a separate thing, because this would be the case if GHE was just "run your own copy of .com."

What is really rough about GHE is that you can't choose a lot of the features or IMO baseline requirements like caching that you've probably come to expect from github.com, and may have been around for years. At least not until they can get GHE to parity with .com.

I'd recommend checking out gitlab for on-prem hosting in an enterprise environment. Works great, integrates with AD/ldap and most of the features are available on the free tier if you want to test it. Practically a drop in replacement for github.

I love GitLab, and am now a shareholder, but advertising it as "drop in replacement" is setting up an evaluator for disappointment

At the very least, they use just absolutely incompatible yaml files for their CI pipelines (in, of course, an incompatible location in the repo)

But probably the bigger obstacle would be their incompatible API (and incompatible auth to it); that means one cannot grab a cool "github bot/tool for doing $X" and expect it to do anything reasonable in GitLab

I wish Gitlab had a form of the Checkruns API and allow you to annotate lines in source files, e.g. your linting errors or that vulnerability integration wasn't only available in Ultimate

I used ReviewDog to wire in Qodana results, so I hear you about wishing it was built in, but it is achievable: https://github.com/reviewdog/reviewdog#reporter-gitlab-merge...

Based on my contact with GitLab's built-in other scanning tools, I wouldn't trust their vuln management further than I could throw it, so you're likely not missing much on that front