GitHub did change pull request license checks

Did GitHub change open source license compliance checks in pull requests

Yes. GitHub now checks open source license compliance in pull requests by comparing dependency changes against a policy, then either annotating the pull request or blocking the merge when the rule is active. The current docs describe this as a ruleset-based feature in public preview.

The part people get wrong is thinking this is the same thing as the older dependency review experience, or that GitHub is just showing a license badge. The new license compliance feature is policy enforcement, not a static repository label. GitHub says it evaluates direct and transitive dependencies when package manifests change, then compares the detected licenses to your policy.

What changed in practice is the enforcement path. GitHub’s current documentation says license compliance is enforced through branch rulesets. In Active mode, pull requests that introduce noncompliant dependencies are blocked until the violation is resolved. In Evaluate mode, GitHub still runs the checks and adds annotations, but it does not block the merge.

That means the check now lives where teams already review code, inside pull requests, instead of only showing up later in a separate compliance process. GitHub’s changelog says that when developers open pull requests that add or modify dependencies, license checks run automatically against the policy and annotate the pull request for noncompliant dependencies. The same changelog also says the feature expands on dependency review.

The inconvenient part is scope. GitHub documents this feature for organizations owned by an enterprise account with GitHub Code Security enabled, not for every repository or every account. The docs also say dependency graph must be enabled for the repositories you want to evaluate. If a team expects universal coverage and only has the feature on one enterprise setup, the check will not appear everywhere they want it.

Another detail people miss is that GitHub does not check the repository’s own LICENSE file in this feature. The compliance check is about dependency licenses, including transitive dependencies, and it relies on detected package manifest changes. A repository can have a valid project license and still fail a pull request because a new dependency is outside policy.

When the check finds a problem, GitHub adds pull request annotations. The docs say those annotations do not automatically create an exception request, because the developer may choose to change the code instead of keeping the dependency. If they do want the dependency, GitHub prompts for more information and sends the request to Enterprise Open Source License Managers, who can modify policy.

If your team is migrating from the older pattern, the practical question is not whether GitHub checks licenses anymore, but which enforcement mode you have turned on and which repositories are in scope. A team can see annotations and assume policy is active everywhere, then later discover that Evaluate mode only reports and does not block. The docs are explicit about that split.

For a concrete example, imagine a pull request that adds a package manifest entry for a dependency whose license is not allowed by your enterprise policy. In Active mode, GitHub blocks merge until the dependency is removed, replaced, or approved through the policy workflow. In Evaluate mode, the same pull request gets annotations, but the merge can proceed unless another protection rule stops it.

The safest way to read the change is this: GitHub moved open source license compliance from a looser review concept into a ruleset-enforced pull request check for enterprise customers. That is a real product change, and it matters because it changes when the issue is seen, who sees it, and whether it can stop a merge.

If you want the feature’s current placement in GitHub’s stack, the official docs and changelog are the right references. GitHub describes license compliance as a public preview feature that works with rulesets and pull requests, and the docs separate policy setup, enforcement, and results. For a team deciding whether to adopt it, that separation is the important thing to verify first.

For DevConnect readers who are mapping this to their own workflow, the takeaway is simple: license compliance is now part of pull request gating for dependency changes, not a side note. If you need a place to coordinate real testing work around that kind of shipping process, you can keep the workflow on your own systems and share the work at https://devconnectplatform.com. That site is separate from GitHub’s enforcement, and it does not change GitHub’s policy behavior.

FAQ

Is this the same as dependency review No. GitHub’s changelog says the new license compliance feature expands on dependency review. The current docs describe a separate policy and ruleset flow for license compliance, with pull request annotations and merge blocking in Active mode.

Does GitHub check only direct dependencies No. The docs say it checks direct and transitive dependencies when policy is enforced. That matters because a pull request can introduce a noncompliant license indirectly through a package you did not add by name.

Will a license annotation automatically open an exception request No. GitHub says annotations do not automatically generate an exception request. The developer is first allowed to change the code, and only if they want to keep the dependency does GitHub prompt for more information and route the request to the policy managers.

Can every GitHub user use this feature No. GitHub documents it for organizations owned by an enterprise account with GitHub Code Security enabled. The docs also say repository dependency graph must be enabled for the repositories being evaluated.

Does Active mode behave the same as Evaluate mode No. Active mode blocks merges until violations are resolved. Evaluate mode runs checks and annotates pull requests, but does not block the merge on its own.