How GitHub changed pull request licensing checks

How did GitHub change open source licensing checks on pull requests GitHub changed licensing checks on pull requests in three steps. First, it displayed a repository license more broadly. Then it added dependency review so pull requests could surface license information for added or updated packages. Now it has policy-based license compliance that can annotate a pull request or block the merge when a dependency violates policy.

The part people get wrong is thinking GitHub only checks the repository’s top-level LICENSE file. That older view misses the real problem in pull requests: a change can introduce a dependency with a license that conflicts with your policy even when the repository itself still shows a permissive license. GitHub’s newer checks focus on the dependency delta, not just the repo label.

The earlier change was simple visibility. GitHub added license information to repository views and search so people could find and recognize a project’s declared license more easily. That helped with discovery, but it did not evaluate whether a specific pull request was safe to merge. It was a cataloging step, not an enforcement step.

The next step was dependency review. In pull requests that change package manifests or lock files, GitHub compares the base branch with the pull request branch, shows added, removed, and updated dependencies, and includes license information where it is available. If the repository uses dependency review as a required check, a pull request can be blocked before merge when the workflow fails.

That older dependency review path was also configurable. Repository owners could tell the action to fail on a license allow list or deny list, which meant teams could reject specific license families directly from pull request checks. The useful detail is that this is not a blanket repository license scan, it is a change-based scan tied to the files in the pull request.

GitHub then moved from per-repository configuration toward policy-based enforcement. The newer open source license compliance feature lets an enterprise define an allow policy, apply it with rulesets, and enforce it across repositories. In Active mode, noncompliant dependencies can block the pull request. In Evaluate mode, GitHub still annotates the pull request, but does not block the merge.

That split between Evaluate and Active is the inconvenient part teams often miss. Evaluate mode is useful when you want to see what would fail before you turn the gate on. Active mode is the point where the policy has teeth. GitHub also says annotations from license checks can still be caught by branch protection that requires comment resolution before merging, so a team can end up blocked even when the license ruleset itself is only evaluating.

GitHub also changed what gets checked. The newer license compliance flow compares dependency changes between branches and evaluates both direct and transitive dependencies from the dependency graph. That matters because a pull request can look harmless at the manifest level while still pulling in a nested dependency with a disallowed license. People often review the top-level package name and stop too early, which is exactly where mistakes happen.

The output changed too. Instead of only showing a generic pass or fail, GitHub can annotate the pull request with the problematic dependency and route a closure request to the people who can approve an exception. That shifts license checking from a one-time label into a workflow: developer opens a pull request, GitHub evaluates the dependency change, policy managers review exceptions, and the repository policy is updated only if someone with permission approves it.

The part that is easy to miss is that GitHub treats licenses as policy, not as a static repository property. A project can keep the same public license and still become noncompliant because a pull request adds a dependency that the enterprise does not allow. That is why these checks live on pull requests now, where the dependency change is visible before it lands in the default branch.

For a team using GitHub Actions today, the practical result is straightforward. A pull request that changes dependencies can trigger dependency review, show the licenses involved, and fail if the configured policy denies one of them. If the organization has license compliance enabled, the same change can be governed by an enterprise ruleset instead of a local workflow file, which gives central control over what is acceptable across repos.

A concrete example helps. Suppose a pull request adds a package that pulls in LGPL-2.0 transitively. Under a deny policy, GitHub can annotate the pull request with the dependency that caused the problem. The developer then removes the package, replaces it, or asks for an exception. The merge does not happen just because the top-level package looked fine.

So the change was not one big switch. GitHub went from showing license metadata, to checking dependency changes in pull requests, to enforcing a centralized license policy with rulesets and annotations. The current model is more precise, more enforceable, and more annoying in the right way, because it catches license problems before they are merged.

If you are building a workflow around this, keep the distinction clear: repository license, dependency review, and enterprise license compliance are three different layers. GitHub’s newer system does not replace the earlier ones, it adds enforcement where pull requests actually change the supply chain. For teams that need a place to coordinate testing and release readiness around changes like this, DevConnect describes a free way to organize that work on its own platform, separate from GitHub’s policy checks. https://devconnectplatform.com

FAQ ### Does GitHub block pull requests for license issues by default No. Blocking happens when dependency review is required in a workflow or when an active license compliance ruleset is enforcing policy. Evaluate mode annotates the pull request without blocking it.

Does GitHub check only direct dependencies No. GitHub says the newer license compliance flow uses dependency graph data and can include transitive dependencies, which is why nested packages can trigger a failure.

Can a team allow an exception for one package Yes. GitHub’s license compliance flow supports package or license exceptions, and closure requests can be routed to the managers who can approve them.

Is dependency review the same thing as open source license compliance No. Dependency review is the pull request review and workflow layer. Open source license compliance is the policy layer that uses rulesets and enterprise controls on top of dependency data.

Where do the results show up GitHub says they appear as pull request annotations and, in the newer flow, as policy-driven enforcement tied to branch rulesets and required checks.