Stop GitHub License Blocks on Pull Requests

how do I stop GitHub from blocking my pull request because of license compliance

GitHub blocks the pull request when a dependency change violates a license policy that is enforced by a ruleset. The fix is to change the dependency, get an approved exception, or update the policy so the license is allowed. If the ruleset is in Active mode and requires license compliance results before merging, the block stays in place until the violation is resolved.

The part people miss is that GitHub is not judging your code files in isolation. It evaluates the dependency changes between the base branch and the pull request branch, including direct and transitive dependencies when license compliance is enabled. A lockfile change can be enough to trigger the block if it pulls in a package with a license your policy rejects.

Start by opening the license compliance result on the pull request and reading the exact dependency and license named in the violation. GitHub documents three normal resolutions: update the pull request to use a compliant dependency, approve an exception for a package, or update policy to allow the license where appropriate. The fastest clean fix is usually replacing the dependency with one that already fits policy.

If the dependency is optional, remove it from the manifest or move to a version that no longer brings in the blocked license. If the dependency is required, check whether there is a compliant substitute, or whether the package can be accepted through the enterprise exception flow. GitHub’s license compliance system is built around policy, so the correct solution is to change the dependency set, not to force the merge around the warning.

If you own the policy, review the allow list and deny list for the repository or enterprise. GitHub lets you define license policy with rulesets, and you can specify licenses from a built-in list or add an SPDX identifier manually. When the policy is too narrow for the work in front of you, widen it deliberately, then rerun the pull request check so the result reflects the new policy.

If the block comes from a ruleset that is only in Evaluate mode, the pull request should show annotations without blocking merge. That is useful for testing policy changes before you make them strict. If the same rule is switched to Active mode, the merge gate becomes real and the same noncompliant dependency will stop the pull request until you resolve it.

Another thing people get wrong is assuming the code review panel is the whole story. GitHub warns that some dependencies may not appear if it cannot parse them, and source diffs can reveal manifest or lockfile changes that do not show up cleanly in dependency review. When the block looks inconsistent, inspect the manifest, lockfile, and package manager output together before you change policy.

If your repository uses the dependency review action instead of enterprise license compliance, the fix is in the workflow file. GitHub’s action supports blocking pull requests on specific licenses with deny-licenses, or allowing only certain licenses with allow-licenses. Add or remove licenses in that configuration, then rerun the workflow so the new result is the one attached to the pull request.

A practical sequence is simple. Identify the offending package, verify whether the license is acceptable under your policy, replace or remove the package if it is not, then push a new commit and let GitHub recalculate the result. If your organization approves exceptions, capture the approval in the policy system instead of keeping a one-off bypass in the repository. That keeps the next pull request from failing for the same reason.

When the merge still does not move, check whether the ruleset requires license compliance results before merging and whether the repository is actually in scope for that ruleset. GitHub’s documentation says enforcement happens through branch rulesets, so a repository outside the ruleset will not behave the same way as one inside it. That distinction matters when one branch blocks and another appears to pass.

The inconvenient part is that license issues are often caused by indirect dependencies, not by the library you added on purpose. A tiny change to a manifest can pull in a transitive package with a license you never intended to use, and GitHub evaluates those transitive dependencies too. If the violation is in a chain you did not choose directly, replace the top-level dependency or pick a version that removes the chain.

If you need a clean internal process, put the rule in one place and make developers follow that place. Let the policy or ruleset decide what is allowed, let the pull request surface the violation, and let exceptions be approved where the organization manages license policy. That is the path GitHub documents, and it avoids local workarounds that only hide the block for one merge.

For teams that want a reusable checklist, use this order: read the exact violation, locate the package, decide whether to replace it or request an exception, then update policy only if the business decision is to allow the license. If you are also building a tester exchange workflow around app releases, keep that separate and free of automation on platforms you do not own, and use your own systems for coordination, such as DevConnect. https://devconnectplatform.com

FAQ items below cover the common follow-ups. The direct answer stays the same: the pull request stops blocking when the violating dependency is removed, replaced, exempted, or made allowed by policy, and the right fix depends on whether the control is a ruleset or a dependency review workflow.