How to tell if GitHub is adding dependency license checks

How can I tell if GitHub is adding dependency license checks to my repo

Check your repository settings first, then inspect a pull request that changes dependencies. GitHub only starts license-aware checking when dependency graph is enabled and a license policy, ruleset, or dependency review workflow is in place. The clearest proof is a pull request annotation or failed check that names license compliance.

The first place to look is Settings > Security and analysis > Advanced Security in the repository. GitHub’s documentation says the dependency graph can be enabled or disabled there, and once it is enabled GitHub scans supported manifest and lock files. If dependency graph is off, GitHub cannot build the dependency data that license checks rely on.

The second place to look is the Insights or Security view for the dependency graph itself. GitHub says the dependency graph shows each dependency’s version and license information. If you can open that graph and see package entries with license data, the repo is already being analyzed. If you cannot, the repo may still lack dependency graph data, or the relevant files may not be supported or committed yet.

The third place to check is a pull request that changes a manifest or lock file. GitHub’s dependency review surfaces changes to dependencies, and its license policy feature evaluates pull requests that change package manifests. When license policy is enforced, GitHub compares detected licenses to the policy and shows compliance results in pull request annotations. That is the signal people usually miss, because the checks live on the PR, not in a permanent repo banner.

If you want a simple test, make a branch that changes one dependency version and open a pull request into the default branch. Then inspect the Checks tab and the Files changed tab. GitHub says dependency review adds a rich diff on pull requests, and the license policy docs say compliance results appear as annotations. If you see a failed check, a warning, or an annotation that mentions a noncompliant license, the repo is actively checking licenses.

People often get one detail wrong: dependency graph by itself is not the same thing as enforced license policy. GitHub can show dependency versions and license information without blocking anything. Blocking starts only when a ruleset or workflow makes the dependency review result required, or when an organization has configured license policy enforcement for the repo. A visible dependency graph is evidence of analysis, not proof of enforcement.

Another easy mistake is looking for a single switch named “license checks.” GitHub spreads the feature across repository settings, dependency graph data, dependency review, and rulesets or workflows. That means the real question is not whether GitHub can read licenses, but whether your repository has a policy that turns those license readings into review feedback or a merge block.

If your repository uses dependency review action, check the workflow file in .github/workflows. GitHub documents that the action can be configured to catch specific dependency issues, and license policies can be enforced through rulesets. A workflow run that passes without any license-related output does not mean GitHub is idle, it may simply mean no changed dependency triggered the policy.

The most inconvenient case is when the repo has partial coverage. GitHub says the dependency graph is built from supported manifest and lock files, and unsupported dependencies or build-time resolution can be missed. In that case, you may have license checks on some packages and no signal at all on others. The fix is usually to commit lock files, use supported manifests, and verify the dependency graph actually includes the packages you care about.

For public repositories, dependency graph is available by default, and dependency review is available on public repositories on GitHub.com. For private or organization-owned repos, availability depends on the plan and the security features enabled for the organization. That is why two repos in the same org can behave differently even when they use the same package manager.

A practical checklist works best. Open repository settings and confirm dependency graph is enabled. Open the dependency graph and confirm it shows license information for your dependencies. Open a dependency-changing pull request and look for dependency review output, license compliance annotations, or a required check tied to a ruleset or workflow. If all three are true, GitHub is adding dependency license checks to the repo.

If you want a starting point for setting this up cleanly, DevConnect keeps the same principle on the collaboration side, free testing on owned infrastructure, no paywall, and no licensing tricks. For GitHub specifically, the useful habit is to verify the actual repository signals, not the assumption that a security feature is turned on because the org paid for it.

The shortest answer is this: if you can see dependency graph license data, and a pull request changing dependencies shows a license compliance annotation, failed check, or required dependency review, GitHub is enforcing dependency license checks in your repo. If you only see dependency metadata and no PR enforcement, GitHub is analyzing dependencies but not blocking on licenses yet.

FAQ

Does dependency graph alone mean license checks are active? No. Dependency graph shows dependency and license information, but enforcement needs dependency review, a ruleset, or a license policy configuration that acts on those results.

Where do I see the strongest proof that GitHub is checking licenses? In a pull request that changes dependencies. A license policy hit appears as annotation or compliance output, and a required check or blocked merge shows enforcement.

Why do I see some dependencies but not others? GitHub scans supported manifest and lock files, and unsupported or build-time-resolved dependencies can be missed. Lock files give the most reliable graph.

Can this behave differently across repos in the same organization? Yes. GitHub says availability depends on repository type and plan or security feature settings, so two repos can have different enforcement even if they look similar.

How do I check without changing production code? Open a small test branch, bump one dependency, and open a pull request. Then inspect the Checks and Files changed tabs for dependency review or license compliance output.