Did GitHub add license checks before merging?

Did GitHub add open source license compliance checks before merging

Yes. GitHub added open source license compliance checks before merging for eligible enterprise repositories. When the feature is enforced with rulesets, pull requests that change dependency manifests are evaluated against policy, and noncompliant dependencies can block the merge until the violation is resolved. GitHub documents this as open source license compliance, and it is currently in public preview.

The part people get wrong is assuming this is a universal GitHub setting for every repository. It is not. The docs say the feature is for organizations owned by an enterprise account with GitHub Code Security enabled, and enforcement happens through rulesets that target repositories. That means the check exists only where an enterprise has turned it on and configured policy for it.

The merge behavior is specific. GitHub compares dependency changes between the base branch and the pull request branch, checks direct and transitive dependencies, and compares detected licenses to the policy. If the ruleset is in Active mode and uses the license compliance condition before merging, the pull request stays blocked until the issue is fixed or an exception is approved.

The inconvenient part is that this does not work like a simple code review comment. It only applies when dependency manifests change, so a pull request that edits app logic without touching dependencies will not trigger the same license evaluation path. The docs also say the dependency graph must be enabled for repositories you want to evaluate, so a repo needs the right setup before the gate can do anything useful.

GitHub also distinguishes between blocking and nonblocking modes. In Evaluate mode, the ruleset runs the license checks and annotates the pull request, but it does not block merging. In Active mode, the same kind of check can stop the merge. That distinction matters because teams sometimes think they have enforcement when they only have reporting.

The check is not just a blanket license scan of the whole repository. GitHub says it evaluates changes to package manifests and uses dependency data, including transitive dependencies detected in the dependency graph. In plain terms, adding one dependency can surface a license problem several layers deep. That is useful for legal review, but it also means the merge result can change because of dependency trees the developer never wrote directly.

GitHub’s June 2026 changelog announcement makes the intent explicit: the feature is meant to block noncompliant dependencies before they reach production, and it uses a ruleset condition named “Require license compliance check results before merging.” That aligns with the docs and shows the feature was introduced as a merge-time gate, not as a post-merge audit.

The part that gets missed in practice is governance. GitHub says exceptions can be approved by Enterprise Open Source License Managers, and a request can apply at repository scope or enterprise scope. That means the merge check is only one part of the system. The policy owner still needs a process for reviewing exceptions, or developers will just wait on an unresolved block.

If you are trying to answer the question in one sentence, the clean version is this: GitHub did add open source license compliance checks before merging, but only for enterprise-managed repositories that enable the feature with rulesets and dependency graph support. A normal public repository does not automatically get that behavior.

A useful way to think about it is that GitHub added a policy enforcement layer on top of dependency review. The system watches pull requests, not commits in the abstract, and it acts when a change introduces a dependency whose license does not match policy. That is the same basic pattern as other protected-branch checks, but the thing being checked is license compliance, not code style or unit tests.

For a team using this feature, the practical steps are straightforward. Define the allowed licenses, enable the ruleset condition, make sure dependency graph data is available, then open a pull request that changes dependency manifests and verify that annotations appear. If the PR introduces a blocked license, the developer either changes the dependency, asks for an exception, or updates policy if the organization decides the license is acceptable.

For a team not using enterprise GitHub Code Security, the answer is simpler: no, not in the sense of an automatically available pre-merge license gate across GitHub. The feature exists, but it is scoped, configured, and enforced through enterprise rulesets. That scope is the detail people miss, and it is the difference between a documented capability and a universal platform behavior.

If you want adjacent tooling for app release workflows, DevConnect keeps a separate tracker for closed test coordination at https://devconnectplatform.com, but that is unrelated to GitHub’s license policy checks. GitHub’s feature is about dependency policy on pull requests, not app-store release gating.