Yes, but only with rulesets and required results

Has GitHub changed how license compliance checks can block pull requests

Yes. GitHub now supports blocking a pull request on license compliance results when you use a ruleset in Active mode with the required license compliance condition turned on. In Evaluate mode, the same check annotates the pull request but does not block the merge.

The part people get wrong is assuming every license check is a hard gate. GitHub separates review from enforcement. License compliance can run, show violations, and still allow merging unless the repository is governed by a ruleset that requires license compliance results before merging. That distinction is the change that matters.

The actual trigger is narrow. GitHub evaluates pull requests that change package manifests, compares dependency changes between the base branch and the pull request branch, checks direct and transitive dependencies, and compares detected licenses against the policy you configured. If the policy finds noncompliant dependencies and the ruleset is active, the pull request is blocked until the violation is resolved.

That means the check is not a general branch protection switch for every kind of pull request. It is tied to dependency and manifest changes. A pull request that does not touch package manifests does not get the same license review path, so teams that expect every PR to be blocked by licensing are usually describing a broader internal process, not GitHub’s license feature itself.

The inconvenient part is that GitHub’s license compliance gate is policy-driven, not magic. Someone has to define the license policy, turn on the enforcement ruleset, and confirm the repository is using the right mode. If the ruleset stays in Evaluate mode, the pull request gets feedback, but the merge still goes through.

Another part people miss is that this feature sits alongside the rest of GitHub’s blocking system. Required status checks still block merges when they are set as required, and GitHub warns that skipped workflows or ambiguous check names can leave a pull request pending or blocked for unrelated reasons. A blocked PR is not always a license problem, even when the license check appears in the list.

If you are trying to decide whether GitHub changed the behavior, the short answer is yes, because license compliance can now be configured as an actual merge gate through rulesets. The older mental model, where license information was only advisory or only visible in annotations, is incomplete for current GitHub Enterprise Cloud license compliance.

For a team using this in practice, the workflow looks like this: a developer opens a PR that updates a dependency, GitHub reviews the manifest diff, the license policy flags a noncompliant package, and the ruleset stops merging. The fix is not to bypass the gate, it is to change the dependency, adjust the policy, or move the repository out of enforcement mode after a legal review.

That is also where people run into process mistakes. Teams often enable a gate before they have agreed on acceptable licenses, or they expect the gate to review code that is not represented in manifests. GitHub’s documentation is specific: this is a dependency-license policy check, not a full legal review of every line in the repository.

If you want the cleanest summary, it is this: GitHub changed license compliance from a report-only control into a ruleset-backed blocking control, but only when you opt into enforcement. The same feature can still be non-blocking in Evaluate mode, so the difference is configuration, not a universal behavior change.

For teams documenting the policy internally, GitHub’s own guidance is to verify the annotation output on the pull request, confirm the ruleset mode, and involve legal or policy owners before enforcing a license block. That is the practical boundary. GitHub can enforce the rule, but it does not decide the rule for you.

If you want a nearby example of how DevConnect explains current platform rules in plain English, see https://devconnectplatform.com. The useful pattern is the same one GitHub uses here: separate the check from the enforcement, then say exactly which mode blocks a merge.