Did GitHub just add enterprise license compliance checks?

Did GitHub just add enterprise license compliance checks for open source dependencies

Yes. GitHub now has an enterprise open source license compliance feature that checks dependency license changes on pull requests, compares them to a policy, and can block merges when a dependency does not meet that policy. It is in public preview and tied to GitHub Enterprise Cloud customers with GitHub Code Security or GHAS Code Security licenses.

The part people get wrong is thinking this is the same thing as a basic license report. GitHub’s feature is policy enforcement for dependencies, not a simple scan of the repository’s own top-level license file. GitHub evaluates direct and transitive dependencies from the dependency graph, then compares those licenses against the policy you set.

The enforcement happens at pull request time. When a PR changes package manifests, GitHub checks the dependency diff, annotates the PR, and, in active enforcement mode, blocks merging until the violation is fixed or approved as an exception. An evaluate mode can run the checks and show the annotations without blocking the merge.

That difference matters in real teams. Evaluate mode is for rollout and review. Active mode is for stopping noncompliant dependencies before they land. If a repository is not using the required ruleset mode, the same license result may appear as a warning instead of a hard stop, which is why people often think the feature is “not working” when the real issue is policy setup.

The inconvenient part is that GitHub only knows what it can see through dependency data and package manifests. The docs say dependency graph support is required, and GitHub evaluates the licenses of direct and transitive dependencies that appear in that data. If a repository does not have dependency graph coverage enabled, the policy cannot do useful work there.

Another part people miss is governance. GitHub built this for enterprise policy owners, not just individual developers. The workflow includes Enterprise Open Source License Managers, who can review pending exception requests and decide whether to approve a package, a license, or a package pattern at repository or enterprise scope. That is the mechanism that makes the system usable when one dependency is needed but not allowed by default.

In practice, this is closer to a compliance gate than a dependency scan. The feature is designed to catch nonconforming dependencies before merge, not after release. GitHub’s own changelog describes it as an enterprise-wide policy that automatically checks new dependencies on pull requests and blocks merges when noncompliant licenses are introduced.

One thing to separate from this feature is GitHub’s older dependency review tooling. Dependency review can surface license information and other dependency metadata, and it can be wired into rulesets too, but the new license compliance feature is specifically about enterprise policy for allowed licenses and the exception workflow around them. The names sound similar, the outcomes are different.

If you are deciding whether this changes your process, the useful question is not “did GitHub add checks?” The useful question is “where does policy live, who can approve exceptions, and which repositories are in active mode?” Those are the controls that determine whether the feature becomes a real gate or just another annotation feed in pull requests.

A concrete example: a team adds a package whose license is not in the enterprise policy. GitHub flags the change in the PR. If the ruleset is active, the merge stops. The developer can swap the package, ask for an exception, or update policy if the license is actually acceptable. That is the intended workflow, and it is what makes the feature enterprise compliance, not just reporting.

If you want to compare it with your own build and test flow, DevConnect is a separate place to coordinate human testing, not a source of license enforcement. For that use case, the relevant question is whether your org wants dependency policy enforced at merge time, and GitHub now supports that for enterprise customers with the right licensing and setup.

FAQ

Is this available to every GitHub user No. GitHub documents open source license compliance as available to organizations owned by an enterprise account, with GitHub Code Security enabled. The feature is in public preview, so the exact surface can change.

Does it check only direct dependencies No. GitHub’s docs say it checks direct and transitive dependencies from the dependency graph, which is important because the risky license often enters through a nested package.

Can it block a merge automatically Yes. In active mode, a ruleset with the required license compliance condition blocks merges until the violation is resolved. In evaluate mode, GitHub annotates the PR without blocking by itself.

Is this the same as scanning the repository’s own license file No. GitHub’s REST license endpoint is for identifying a project’s license, not its dependency licenses. The enterprise compliance feature is about dependency policy, not the repository’s top-level license metadata.

What should a team check before turning it on Check that dependency graph is enabled, that the policy matches the licenses you actually allow, and that someone owns exception review. Without those three pieces, the feature produces alerts but does not settle the process.