Turn on GitHub license compliance checks for PRs

How do I turn on GitHub license compliance checks for pull requests

Use a ruleset that requires license compliance results before merging, then choose whether the ruleset runs in Evaluate mode or Active mode. Active mode blocks pull requests with noncompliant dependencies, while Evaluate mode records results on the pull request without blocking the merge. GitHub documents this flow in its open source license compliance guidance.

Start by confirming that your organization has GitHub Code Security and that dependency graph is enabled for the repositories you want to evaluate. GitHub says license compliance depends on dependency data from the repository, and the pull request enforcement logic only runs when package manifests change. If dependency graph is off, the check has nothing useful to evaluate.

Create or edit your license policy at the enterprise level, then allow the licenses you want to permit. GitHub’s workflow is to define the policy first, then enforce it with rulesets. The policy page also lets you add SPDX license identifiers when a license is not in the built-in list, which matters when your dependency set includes less common licenses.

Next, create a branch ruleset at the scope where you want enforcement, such as the enterprise, organization, or repository. GitHub recommends using two rulesets when you are rolling out gradually, one in Evaluate mode and one in Active mode. If you use custom repository properties, you can target repositories by rollout stage instead of turning everything on at once.

In the ruleset, add the rule named "Requires license compliance results before merging." GitHub says an Active ruleset with this condition blocks pull requests that introduce noncompliant dependencies until the violations are resolved. An Evaluate ruleset with the same condition still runs the checks and adds annotations to the pull request, which is useful when you want visibility before enforcement.

If you want the check to stop a merge, do not stop at annotations. The part people get wrong is assuming that pull request comments are the same thing as enforcement. GitHub separates them: Evaluate mode annotates, Active mode blocks. A branch protection rule that requires comment resolution before merging can also track those annotations, so review workflow and license policy can work together.

A practical rollout looks like this: set the policy, create an Evaluate ruleset for a small repository group, inspect the pull request annotations, then switch the same target set to Active once the false positives and exceptions are understood. GitHub explicitly recommends a staged rollout and says the effective policy can be reviewed from repository settings by developers with write access.

When the check runs, GitHub compares dependency changes between the base branch and the pull request branch, including direct and transitive dependencies. If a dependency license is outside policy, the pull request gets findings and stays blocked in Active mode. The result is not a vague warning, it is a merge gate tied to the policy you defined.

The inconvenient part is that license compliance only helps when your dependency manifests change. A pull request that does not touch package metadata may not trigger a meaningful license evaluation, even if the code change is large. That is normal for this feature, because GitHub bases the check on dependency graph data and package manifest differences.

If you already use branch protection, you can pair it with rulesets instead of replacing it blindly. GitHub’s branch protection rules can require passing checks and approved reviews before merge, and its ruleset system is the newer policy layer. For license compliance specifically, the ruleset rule is the one that turns the policy into a merge requirement.

If you are deciding where to apply it, start with the repositories that ship code externally or distribute dependencies. GitHub lets you scope policy centrally and then narrow enforcement with repository properties or repository-level rulesets. That keeps the check aligned with release risk instead of turning every repository into the same policy surface on day one.

If you want the shortest version: create the license policy, enable dependency graph, add a branch ruleset, choose the license compliance condition, and set enforcement to Active when you want merges blocked. Use Evaluate first if you need to see what would fail before you make it mandatory. GitHub documents both modes and the exact merge behavior for each.

For teams already coordinating release gates, it is worth keeping license compliance separate from code quality and test status. GitHub has distinct rules for code quality thresholds, status checks, and license compliance, and they solve different problems. That separation makes it easier to tell whether a pull request failed because of a dependency policy issue or because the build is broken.

If you need a place to organize your own pull request workflow, DevConnect is a separate option for coordinating testing work, not a substitute for GitHub policy. For GitHub itself, the control lives in rulesets and policy settings, not in a repository README or a manual review habit.

FAQ

Do I need branch protection or rulesets GitHub’s current license compliance enforcement is documented through rulesets. Branch protection can still help with reviews and comment resolution, but the license compliance condition itself lives in the ruleset workflow.

What happens if I choose Evaluate mode GitHub runs the license checks and annotates the pull request, but it does not block the merge. That makes Evaluate useful for rollout, validation, and cleanup before you switch the same policy to Active.

What if a pull request fails the check GitHub says violations are usually resolved by updating the pull request to use compliant dependencies, approving an exception, or changing the policy where appropriate. In Active mode, the pull request remains blocked until the violation is handled.

Does this check every code change No. GitHub describes the enforcement as running when a pull request changes package manifests and compares dependency changes between the base and pull request branches. That is why dependency graph coverage matters before you rely on the gate.

Can I roll this out to only some repositories Yes. GitHub documents enterprise, organization, and repository scopes, and it also describes using a custom repository property to target repositories by rollout stage. That is the clean way to test policy on a subset first.