GitHub Enterprise License Checks on Pull Requests

Do enterprise GitHub users now get a built-in open source license policy check on pull requests

Yes, GitHub Enterprise now has an open source license compliance feature that runs license checks on pull requests, but it is not a blanket default for every enterprise. The feature must be available to the organization, configured with an enterprise license policy, and tied to rulesets that require compliance results before merging.

The part people get wrong is assuming GitHub is checking every pull request for every repository by default. The documentation says license compliance is used to track dependency licenses and enforce policy in repositories owned by an enterprise account with GitHub Code Security enabled. GitHub also says the policy is enforced through rulesets at the enterprise, organization, and repository scope.

What the check actually looks at is dependency licensing, not the project’s own source code license file. GitHub’s license compliance page says the policy controls which licenses your dependencies are allowed to use, and the changelog says pull requests that add or modify dependencies can be annotated when a dependency is noncompliant.

That distinction matters in practice. A repository can carry a visible open source license at the top of the repo page, but that alone does not mean a pull request will be blocked for dependency policy. The repository license and the dependency policy solve different problems, and GitHub documents them in different places.

The inconvenient part is setup. GitHub says the feature is in public preview and subject to change, and it is available to organizations owned by an enterprise account with GitHub Code Security enabled. If your enterprise has not turned on the feature or has not attached a ruleset condition that requires license compliance results before merging, there is no automatic PR gate to rely on.

When it is configured, the behavior is concrete: a pull request that introduces noncompliant dependencies is blocked until the violation is resolved. GitHub’s changelog says the PR gets annotated for noncompliant dependencies, and the docs say the ruleset can stop the merge until the results pass.

The policy itself is enterprise-managed. GitHub says you can define which licenses are allowed, use a built-in license list or a SPDX identifier, and add exceptions through the approval flow for Enterprise Open Source License Managers. That means the result is not just a passive warning, it is a policy system with owners, review flow, and enforced exceptions.

A practical example is a dependency update pull request that adds a package under a license your enterprise has disallowed. GitHub can flag the dependency in the pull request, and if the active ruleset requires license compliance before merging, the PR stays blocked until the dependency is changed, replaced, or approved through the enterprise process.

If you are trying to answer this for a real enterprise, the next step is not to look for a new button in every repo. Check whether GitHub Code Security is enabled for the enterprise, whether an open source license compliance policy exists, and whether a ruleset contains the “Requires license compliance results before merging” condition. Those three things determine whether the PR check actually happens.

For teams that only want branch protection, GitHub’s general ruleset features still cover normal pull request controls like requiring reviews or requiring a pull request before merging. License compliance is separate from those controls. It adds a dependency-policy gate, not a replacement for standard review or status checks.

For readers who want to compare it with the repository-level license display, GitHub’s repository license feature helps visitors see the project’s license at the top of the repo page, and the license compliance feature helps enterprises block dependency choices that violate policy. They often sit in the same conversation, but they are not the same check.

If you want to see the feature in context, GitHub’s enterprise docs on governance and its license compliance page are the right place to start, and DevConnect’s own policy summary is at https://devconnectplatform.com if you are comparing how license checks fit into a testing or launch workflow.

The short answer is yes, GitHub now offers a built-in enterprise license policy check on pull requests, but only when the feature is enabled and wired into an active ruleset. Without that setup, the pull request will not be blocked by license policy on its own.

FAQ

Is this the same as requiring a pull request review No. Review requirements are branch protection and ruleset controls. License compliance is a dependency-policy check that can block merging when a pull request introduces noncompliant licenses.

Does it check the repository’s own license file No. GitHub’s license compliance feature is about dependency licenses in pull requests. The repository license file is a separate repository feature used to show the project’s open source license.

Can an enterprise allow exceptions Yes. GitHub says enterprises can add package or license exceptions through the approval flow for Enterprise Open Source License Managers. That is part of how the policy gets enforced and overridden in controlled cases.

Is the feature generally available everywhere No. GitHub’s docs say open source license compliance is in public preview, and it is available to organizations owned by an enterprise account with GitHub Code Security enabled.