How GitHub license checks affect pull requests

How do GitHub license compliance checks affect my pull requests

GitHub license compliance checks affect pull requests that change package manifests. GitHub compares the dependency changes between the base branch and the pull request branch, checks the detected licenses against your policy, and then reports any violations on the pull request. In an Active ruleset, those violations block merging until you fix them.

The part people get wrong is assuming every license warning is just informational. GitHub splits the behavior by ruleset mode. In Evaluate mode, the check runs and annotates the pull request, but it does not block the merge. In Active mode, the same violation becomes merge protection, so the pull request stays blocked until the noncompliant dependency is resolved.

License compliance is not a general code-quality scan. It is tied to dependency policy and to changes in package manifests. GitHub says it evaluates direct and transitive dependencies from the dependency graph, so a pull request can fail even when the code you changed looks harmless. A dependency update, a lockfile change, or a manifest edit can trigger the check.

What you see in the pull request is a result, not a policy explanation. The check can show annotations and violations in the pull request, and reviewers can use that signal to decide whether the change is ready. If your repository uses required checks on a protected branch, a failed license compliance result prevents merge just like another required status check.

The inconvenient part is that the fastest fix is not always the nicest one. If the dependency is noncompliant, you usually have to replace it with a compliant package, request an exception if your enterprise allows that path, or update the policy to permit the license where that is acceptable. GitHub documents those as the normal resolution paths.

The check only helps if the repository is set up for it. GitHub says license compliance enforcement depends on rulesets, dependency graph data, and a policy defined at enterprise, organization, or repository scope. If a repository does not have that configuration, the pull request will not be evaluated the same way, even if the project uses licenses that would matter under policy.

A practical example: suppose your pull request updates a package that brings in a transitive dependency with a disallowed license. GitHub compares the dependency trees, flags the violation, and adds the result to the pull request. In Evaluate mode you can still merge after review. In Active mode you must change the dependency, get an exception, or change policy before merge.

GitHub also treats this as supply-chain governance, not just a repository setting. The policy can be managed at multiple scopes, and the enterprise license manager workflow can be part of the resolution process. That is why the same pull request can be blocked in one org and only annotated in another, even when the code diff is identical.

If you want to test how your repository behaves, open a pull request that changes a package manifest and look for license compliance annotations in the Checks tab. If the branch is protected and the ruleset is Active, the merge button stays blocked until the violation is cleared. If the ruleset is Evaluate, you will see the signal without the block.

For teams that want to keep merges moving, the useful habit is to check dependency changes before the pull request is opened. That avoids the late surprise where code review is done but merge still fails on licensing. If you want to pair this with a lightweight workflow for testing and review, DevConnect keeps that kind of coordination free at https://devconnectplatform.com.

What changes in a pull request can trigger license compliance checks

Pull requests that change package manifests are the main trigger. GitHub compares the dependency changes between branches and evaluates the licenses for the dependencies it detects. Lockfile changes can matter too, because they can change the resolved dependency set even when application code stays the same.

Does a failed license compliance check always block merge

No. The enforcement mode decides that. Evaluate mode runs the check and annotates the pull request, but does not block merging. Active mode uses the same policy result as merge protection, so a noncompliant dependency blocks the pull request until the problem is fixed.

Can transitive dependencies cause a pull request to fail

Yes. GitHub says license evaluation uses dependency data from the dependency graph, including transitive dependencies. That means a nested package can create the violation even when your direct dependency list looks clean. Teams often miss this because the triggering package is not the one they edited by hand.

What are the normal ways to resolve a blocked pull request

GitHub documents three common paths: update the pull request to use compliant dependencies, approve an exception for a package, or update policy to allow a license where appropriate. The right choice depends on your org’s policy, not on the pull request author’s preference.

Is license compliance the same as code scanning

No. Code scanning checks for security issues in code, while license compliance checks dependency licenses against policy. They can both appear in pull requests, but they answer different questions and may block merges for different reasons.

Sources

• GitHub Docs, About open source license compliance: https://docs.github.com/en/code-security/concepts/supply-chain-security/open-source-license-compliance
• GitHub Docs, Configuring open source license policies: https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-license-policies
• GitHub Docs, Status checks: https://docs.github.com/en/pull-requests/reference/status-checks
• GitHub Docs, GitHub Apps documentation: https://docs.github.com/en/apps
• GitHub Docs, About using GitHub Apps: https://docs.github.com/en/apps/using-github-apps/about-using-github-apps