Open source license compliance generally available
By Steven Van ·
Available to GitHub Enterprise Cloud customers with Code Security, it adds ruleset-based license checks on pull requests and new policy APIs.
Open source license compliance is now generally available for GitHub Enterprise Cloud customers, including data-resident GHEC. It applies to repositories that have GitHub Code Security enabled. The feature was previewed publicly in June, and the documentation describes how it works.
How enforcement works
License compliance builds on the dependency review action by adding an enterprise-wide license policy. Admins choose allowed licenses from a built-in list, or add a license by its SPDX identifier if it is not listed. The policy takes effect on repositories targeted by a ruleset that uses the new "Require license compliance results before merging" condition. Rulesets can be defined at enterprise, organization and repository scope.
When a pull request adds or modifies dependencies, GitHub compares the base and pull request branches and checks the licenses of each new or changed dependency, including transitive ones found in the dependency graph. Each noncompliant dependency is annotated on the pull request.
- A ruleset in Active mode blocks merging until violations are resolved.
- A ruleset in Evaluate mode runs the checks and annotates the pull request but does not block the merge.
- A branch protection rule requiring comment resolution also tracks the annotations, including those from Evaluate rulesets.
Resolving violations and exceptions
A developer can remove or replace the dependency, amend the license policy, or create a package exception. Annotations do not create exception requests automatically, since the developer may change their code instead. If they want to keep the dependency, GitHub asks for more information and sends the request to the Enterprise Open-Source License Managers, a new predefined enterprise role. Managers get email notifications and can review pending requests from the enterprise console. Developers with write access can see a repository's effective policy and exceptions on its license policy settings page.
For large enterprises, the documentation suggests setting broad policy centrally, assigning the manager role to policy reviewers, and using a repository custom property (inactive, evaluate or active) that rulesets target to set the enforcement mode per repository.
Changes since the June preview
- License data is now available for GHEC data residency customers. It also fills in license information in the dependency graph and Software Bill of Materials (SBOM) exports.
- License policy changes now emit audit log events, for integration with external systems of record.
- New API endpoints download, update and replace the enterprise license policy.
- A new API endpoint checks whether packages comply with policy, so coding agents can avoid suggesting or adding packages that violate an organization's license rules.
