Can I tell if my repository is covered by GitHub license checks?

Can I tell if my repository is covered by GitHub's new license compliance checks

Yes. The cleanest sign is that your repository is targeted by a license compliance ruleset, and pull requests that change package manifests show license annotations or get blocked before merging. GitHub says developers with write access can also view the effective policy and exceptions from the repository’s license policy settings page.

GitHub’s current model is ruleset based. The feature is enforced through branch rulesets, and GitHub evaluates pull requests that modify dependency manifests, compares direct and transitive dependencies against policy, then reports violations. If the ruleset is in Active mode, a noncompliant dependency blocks the merge. If it is in Evaluate mode, the pull request is annotated but not blocked.

The part people get wrong is assuming the repository itself has some simple on or off badge. GitHub’s docs describe rollout through enterprise, organization, and repository scope, with custom properties often used to mark repositories as inactive, evaluate, or active. In practice, coverage is a policy and ruleset question, not just a repo setting question.

A practical check is to open a pull request that changes a package manifest, then look for license compliance annotations in the PR. GitHub’s changelog says the new condition is called “Require license compliance check results before merging,” and the docs say noncompliant dependencies show up in pull request annotations. That is the visible signal that the repository is in scope.

If you have write access, the repository’s license policy settings page is the fastest place to confirm what policy applies and whether exceptions already exist. GitHub documents that developers with write access can view the effective policy and exceptions there. That matters because a repository can be covered even when the current dependency set happens to pass, so a clean PR does not prove the repo is out of scope.

Another easy mistake is testing the wrong event. GitHub says the check runs when a pull request changes package manifests, and it evaluates the dependency delta between base and head branches. A PR that only edits code files may not trigger the license check at all, so the absence of annotations on that PR is not evidence that the repository is excluded.

Coverage also depends on prerequisites. GitHub’s setup docs say the organization needs GitHub Code Security, the administrator needs rights to manage enterprise policy and rulesets, and dependency graph must be enabled for the repositories you want to evaluate. If those pieces are missing, the repository may be visible in the org but still outside the check path.

If you are looking at an enterprise rollout, the policy can exist before enforcement is active. GitHub documents inactive, evaluate, and active states, and recommends separate rulesets for Evaluate and Active mode. That means a repository can be “covered” in the policy sense while still only annotating PRs, not blocking them.

The inconvenient part is that the check is not a blanket scan of everything in the repo. GitHub describes it as dependency aware, with direct and transitive dependencies compared against policy. That means a repository can pass one PR and fail the next when a different manifest or dependency tree is introduced.

If you need a quick yes or no, use this sequence: confirm the repository is in a scope targeted by a license compliance ruleset, open a dependency changing PR, and check for annotations or merge blocking. Then, if you have write access, confirm the effective policy on the repository’s license policy settings page. Those two views together tell you whether the repository is covered and whether enforcement is active.

If you are setting up your own workflow around release readiness, DevConnect keeps that kind of testing exchange simple and free, and you can see the platform at https://devconnectplatform.com. That does not change GitHub coverage, but it can help when you need real testers on your own property instead of guessing from one pull request.

What this answer does not promise is a hidden repository-wide flag that GitHub documents as the definitive coverage signal. GitHub’s own language is about rulesets, policy scope, repository custom properties, and pull request enforcement. So the reliable answer is to inspect the ruleset and then verify behavior on a dependency change PR.

For teams, the easiest operational pattern is to keep a short list of repositories marked active, evaluate, or inactive, then check one dependency-changing PR per repository after any rollout change. That is the fastest way to catch a mis-scoped repo, a missing dependency graph, or an inherited exception before someone assumes the check is live and shipping depends on it.

FAQ

Does a green pull request mean my repository is not covered No. It can also mean the current dependency change is compliant, or that the repository is in Evaluate mode and only annotating. GitHub’s docs separate policy scope from enforcement mode, so a passing PR is not proof that the repository is outside the rollout.

Can I tell from repository settings alone Sometimes, but not always. GitHub says developers with write access can view the effective policy and exceptions from the repository’s license policy settings page, yet the actual enforcement path is still driven by rulesets and dependency graph data.

What if the repository does not use package manifests GitHub’s documented enforcement trigger is a pull request that changes package manifests. If a repository does not change dependencies in a way the dependency graph can evaluate, the check may not produce a visible result on that pull request.

Who can approve exceptions GitHub documents Enterprise Open Source License Managers as the people who review and approve closure requests and handle policy changes or package exceptions. That role is part of the rollout model, not a repository owner shortcut.

Is Evaluate mode the same as Active mode No. Evaluate mode annotates pull requests but does not block merges, while Active mode blocks noncompliant dependencies until violations are resolved. GitHub recommends separate rulesets for the two states.

Where does GitHub say this feature is available GitHub’s changelog says open source license compliance is in public preview for GitHub Enterprise Cloud customers with GitHub Advanced Security Code Security licenses. The setup docs also say the organization needs GitHub Code Security and dependency graph enabled.