Did GitHub change license enforcement in pull requests?

Did GitHub change how open source licenses are enforced in pull requests

Yes. GitHub moved open source license enforcement into ruleset-based pull request checks for dependency changes. The current model compares the base branch and the pull request branch, evaluates detected licenses against policy, and then either annotates the pull request or blocks the merge when enforcement is active.

The part people miss is scope. GitHub is not talking about every file in a repository or every line of application code. The license compliance feature is about dependencies, package manifests, and the licenses those manifests bring into the tree. GitHub’s docs say the check runs when a pull request changes package manifests and uses dependency graph data, including transitive dependencies.

The enforcement model also changed in a practical way. GitHub documents two modes in rulesets: Evaluate and Active. Evaluate runs license checks and adds annotations without blocking merges. Active adds the requirement to merge only after compliance results pass, so a noncompliant dependency can keep the pull request blocked until the violation is fixed or an exception is approved.

That is the part people often get wrong. GitHub did not simply add a warning banner to pull requests, and it did not make license review a manual-only approval step. The feature is policy-driven, tied to enterprise rulesets, and it can stop the merge when the policy says the dependency is not allowed. The pull request becomes the enforcement point, not just the review surface.

The inconvenient part is that this is not available as a universal GitHub feature for all repositories. GitHub says open source license compliance is in public preview and is available for organizations on GitHub Enterprise Cloud with GitHub Code Security and, in the changelog, for customers with GitHub Advanced Security Code Security licenses. In other words, this is an enterprise governance feature, not a default setting for every public repo.

Another detail people miss is that license compliance is policy plus exceptions. GitHub lets enterprise policy managers approve package, license, or package-pattern exceptions, and those exceptions can be applied at repository or enterprise scope. That means a blocked pull request is not always solved by rewriting code. Sometimes the fix is policy work, and sometimes it is an explicit exception request handled by the people who control the rules.

If you are trying to understand the older behavior, the simplest answer is that GitHub has expanded from showing license information to enforcing license policy in the pull request flow. GitHub has shown repository license metadata for years, but the newer change is enforcement through dependency review, rulesets, and compliance checks that run before merge. That is a real shift from visibility to gatekeeping.

A concrete example makes the change easier to see. Suppose a pull request upgrades a package and pulls in a license your enterprise policy forbids. Under the new workflow, GitHub evaluates that dependency change against the policy, annotates the pull request, and, in Active mode, blocks merging until the dependency is replaced, the policy is changed, or an exception is approved.

If you only want the short version, the answer is yes: GitHub changed license handling in pull requests from display and review into enforced policy checks for dependency changes. The key words are rulesets, dependency graph, annotations, and merge blocking. Those are the pieces that actually changed the workflow.

For teams adopting this, the first step is usually not policy writing. It is checking whether dependency graph data is enabled, whether the repositories are targeted by the right ruleset, and whether the team wants Evaluate mode first or Active mode right away. GitHub’s own setup flow recommends testing enforcement on a pull request that changes dependency manifests, then reviewing the annotations and unresolved violations before turning on stricter blocking.

For readers who build on GitHub but do not administer an enterprise license policy, the practical takeaway is smaller. You may see annotations, blocked merges, or exception requests in pull requests, but those are signs of the enterprise policy layer at work. They are not a general change to how GitHub treats every open source pull request on the platform.

If you want to compare this with your own workflow, DevConnect is a separate place to coordinate testing and shipping work, and its public materials can help with that context. The point here is still the same, though: on GitHub, license enforcement in pull requests is now policy-based and merge-aware, not just informational. https://devconnectplatform.com

FAQ

Is this the same thing as dependency review No. GitHub’s newer license compliance feature builds on dependency data and pull request checks, but it is described as enterprise policy enforcement through rulesets. It compares dependency changes to policy and can block merges in Active mode, which is more explicit enforcement than a simple review comment.

Does GitHub check licenses in every pull request No. GitHub says the check runs when a pull request changes package manifests and evaluates dependency changes against policy. That means code-only changes without dependency manifest changes are not the same case, and repositories need the relevant dependency data and ruleset setup for enforcement to work.

Can a blocked pull request still be merged Not while the Active ruleset requirement is failing. GitHub says unresolved noncompliant dependencies keep the pull request blocked until the dependency is fixed, the policy is updated, or an approved exception resolves the violation.

Who can approve exceptions GitHub assigns that work to enterprise-level license policy managers. They review pending requests in enterprise security views and can approve package, license, or package-pattern exceptions at repository or enterprise scope.

Is this feature available to every GitHub user No. GitHub documents it for GitHub Enterprise Cloud customers with GitHub Code Security or GitHub Advanced Security Code Security licenses, and it is in public preview. That makes it an enterprise feature with change risk, not a universal default.