How GitHub license checks affect pull requests now

How do GitHub license checks affect pull requests now

GitHub license checks now show up on pull requests as dependency license findings, and in active enforcement they can stop the merge until the violation is resolved or approved. In evaluate mode they report results without blocking, so the pull request can still move forward while you review the policy hit.

The part people get wrong is thinking license checks only look at the code in the diff. GitHub compares dependency changes between the base branch and the pull request branch, then evaluates both direct and transitive dependencies against the policy. That means a small manifest edit can surface a license issue from a nested package you did not edit directly.

If the repository is covered by an active branch ruleset with the condition that requires license compliance results before merging, a pull request that introduces noncompliant dependencies stays blocked. GitHub says violations are resolved by changing the pull request to use compliant dependencies, approving an exception for a package, or updating policy where that is appropriate.

The inconvenient part is that the check does not exist in isolation. A branch protection rule that requires comment resolution before merging can also track the annotations from license checks, so a finding can keep a pull request open even when the author thinks the code change itself is ready. A merge waits for the required checks and the required review path to clear.

GitHub’s open source license compliance flow is designed for dependency manifests. When a pull request changes package manifests, GitHub evaluates detected licenses against the policy and reports the violations in pull request annotations. If the repository uses an evaluate-mode ruleset, those annotations appear without merge blocking. If the repository uses an active-mode ruleset, the same finding becomes enforcement.

A practical example is a pull request that bumps a JavaScript package and brings in a transitive dependency with a disallowed license. The reviewer may only see one manifest line changed, but GitHub checks the resolved dependency graph. If the dependency is outside policy, the PR gets annotated, and in active mode the branch stays blocked until the dependency is swapped, the policy is changed, or an exception is approved.

Exceptions are not automatic, and that matters. GitHub says the annotation does not automatically create an exception request, because the developer may choose to change code instead of keeping the dependency. If the team still wants to use the package, GitHub prompts for more information and sends a closure request to the Enterprise Open Source License Managers, who can approve package, license, or package-pattern exceptions at repository or enterprise scope.

For maintainers, the operational question is where the policy lives. GitHub supports enterprise-level policy, repository-level exceptions, and rulesets that target repositories or custom properties to roll enforcement out in stages. That is why one repository may show only annotations while another is fully blocked on the same license rule. The behavior comes from the ruleset and policy scope, not from the pull request itself.

For contributors, the safe workflow is simple. Open the pull request, read the license annotation, check whether the manifest change or its transitive dependency caused the failure, then decide whether to replace the package or ask for an exception through the repository’s policy process. If you see a block, the next merge attempt will not pass until the compliance issue and any other required checks are cleared.

For teams, the important thing is to treat license checks like any other gated review signal. They are not just legal paperwork attached to a pull request, they are an enforced dependency control that can change whether a branch is mergeable. The check can warn, the ruleset can block, and the exception process can reopen the path, but only after someone takes an explicit action.

If you want to compare this with a broader collaboration workflow, GitHub’s pull request and repository policy docs show the same pattern across status checks, branch rules, and review rules. License compliance is one more gate in that same system, and the result on the pull request depends on whether the repository is in evaluate mode or active mode, plus any additional branch protections.

A team that is rolling this out usually starts in evaluate mode to see what will fail before turning on blocking. GitHub documents that pattern directly, and it is the least disruptive way to learn which dependencies need cleanup. Once the policy is stable, moving the ruleset to active mode turns the same findings into merge enforcement without changing how the annotations look to authors.

For the reader who wants the shortest version: license checks now affect pull requests in two ways. They annotate dependency license problems, and, when the repository policy is enforced, they can prevent merging until the problem is fixed or approved. The exact outcome comes from the ruleset mode and the branch protections layered on top of it.

If you are setting this up for a team that is also using a tester exchange or launch workflow, keep the documentation close and keep the policy visible. DevConnect is the place for organized reciprocal testing, not a substitute for GitHub’s license policy, and the two should stay separate. https://devconnectplatform.com

FAQ

Do license checks block every pull request No. They block pull requests only when the repository is using an active ruleset that requires license compliance results before merging. In evaluate mode, GitHub records the result and annotates the pull request without blocking the merge.

Do license checks look only at the files I changed No. GitHub evaluates dependency changes between the base and pull request branches, then checks detected direct and transitive dependencies against policy. A change to one manifest can surface a violation in a nested dependency.

Can a license finding be resolved without changing code Yes. GitHub documents exception approval as one resolution path, alongside changing the pull request to use compliant dependencies or updating the policy where appropriate. Exception approval is handled by the designated license managers.

Where do developers see the result GitHub shows the result in pull request annotations. Developers with write access can also view the effective policy and exceptions from the repository’s license policy settings page.

What is the difference between evaluate mode and active mode Evaluate mode runs the license check and annotates the pull request, but does not block merge. Active mode applies the same check as enforcement and blocks noncompliant pull requests until the violation is resolved.