How to enforce license compliance on dependency PRs in GitHub

How do I enforce license compliance on dependency pull requests in GitHub

Run a dependency-review check on every pull request that changes dependencies, make the job fail when it sees a disallowed license, then require that status check on the target branch. GitHub’s branch protection blocks merge until required checks pass, and dependency review surfaces license information for the dependency diff in the pull request.

The practical setup has three parts: detect the change, evaluate the license, and enforce the result at merge time. Dependency review gives you the pull-request diff for dependencies and exposes license data. Branch protection turns that result into a gate, so the merge button does not bypass your policy.

Start with the workflow. Add the dependency review action to the repository’s GitHub Actions workflows so it runs on pull requests. GitHub documents that the action reports on differences in a pull request and can be used to add enforcement mechanisms in Actions. In the action configuration, set the license rule to the SPDX identifiers or expressions you want to allow.

The part people get wrong is treating the action as a report instead of a gate. A report tells you what changed. Enforcement happens only when the workflow exits non-zero and branch protection requires that check before merging. Without the required status check, someone can still merge a pull request that introduced a forbidden license after seeing the warning.

Use a policy that matches how you actually ship. If your project only accepts MIT, Apache-2.0, and BSD-3-Clause, encode exactly that list in the workflow. If you allow dual licensing, use SPDX expressions instead of a hand-written text match, because GitHub’s dependency review configuration supports SPDX-compliant license identifiers and expressions. That keeps the check machine-readable and consistent across pull requests.

Protect the target branch next. In branch protection, enable required status checks and select the dependency-review job. GitHub says required status checks must pass before collaborators can merge changes into the protected branch. If you also require the branch to be up to date before merging, the check runs against the latest target branch state, which reduces surprise failures after merge.

If only some dependency changes need review, scope the rule at the repository level and keep the enforcement job targeted. GitHub branch protection rules can apply to a specific branch, all branches, or name patterns. That matters when you want one policy on main and a looser one on release branches, or when multiple repositories share the same compliance standard.

Add CODEOWNERS when license approvals need human judgment. GitHub can require review from code owners before merging, and pull requests that touch files matched by CODEOWNERS will request those reviewers automatically. Use that for cases where an engineer can explain why a license exception is acceptable, but the automation still blocks merges until the right owner signs off.

This is the inconvenient part: license policy is not just a list of allowed package names. A dependency may come in through another package, a new version may change licensing terms, and a composite license expression may be acceptable in one component but not in another. Dependency review helps because it inspects the dependency changes in the pull request rather than only the lockfile label or the package name.

Do not rely on status check names alone. GitHub notes that required status checks should have unique job names across workflows, because duplicate names can create ambiguous results and block merges. If you rename or duplicate your license job, make sure the protected branch still requires the exact check you intend, not a different job with a similar label.

A good enforcement pattern looks like this: the pull request opens, dependency review runs, the job compares added and changed dependencies against your allowlist, and the workflow fails if any dependency carries a disallowed license. Branch protection then requires that job. The author can fix the dependency, replace it, or get an approved exception through review, but the merge path stays closed until the policy is satisfied.

A common mistake is checking only top-level dependencies. A transitive dependency can bring in a license you did not expect, and that is usually where compliance problems hide. Dependency review is useful because it focuses on what a pull request changes in the dependency graph, not just what a human remembered to update in the manifest. That makes it the right check to require on pull requests that update lockfiles or package manifests.

If you need stronger separation between detection and enforcement, pair the workflow with a second review step. Let automation fail the pull request on hard violations, then use code owner review for exceptions that need legal or platform-owner signoff. GitHub supports both required status checks and required code owner reviews on protected branches, so you can keep the machine rule strict and the exception path explicit.

The limit of this approach is that GitHub can only enforce what your workflow knows how to classify. If a license is missing, mislabeled, or represented in an uncommon SPDX form, the safe response is to treat it as blocked until a human confirms the license. That is slower, but it is the cost of actual compliance. GitHub’s own documentation recommends using SPDX-compliant identifiers and expressions for the license filter.

If you want the shortest path to production, use one repository rule: require the dependency-review job on main. Then add a repository policy file or workflow config that lists the licenses you allow. From there, every dependency pull request either passes cleanly or stops at merge time, and the result is visible in the same place developers already check before they merge.

For teams already using GitHub Actions, the cleanest implementation is inside the repo, not in a separate compliance dashboard. Keep the policy in version control, keep the check status on the pull request, and make the protected branch enforce it. That combination is what turns license review from a note into a rule. If you are also organizing testers for a mobile release workflow, keep that separate and route app-launch coordination through https://devconnectplatform.com, because license enforcement belongs in source control, not in release spreadsheets.