GitHub Brings Open Source License Compliance to Public Preview, Letting Enterprises Block Noncompliant Dependencies

Overview

GitHub has moved its new License Compliance feature into public preview, giving customers a way to define enterprise-wide license policy for open-source dependencies and block pull requests that introduce packages whose licenses violate that policy, according to GitHub’s changelog published June 30, 2026. The feature targets a familiar pain point in software supply chains: dependencies that arrive with unfamiliar or restrictive licensing terms that create legal exposure once code reaches production.

What We Know

The feature is limited to a specific slice of GitHub’s customer base. “License compliance is available today in public preview for all GitHub Enterprise Cloud customers with GitHub Advanced Security Code Security licenses,” according to GitHub. Open Source For You confirmed the same requirement, reporting that the tool “is available to GitHub Advanced Security (GHAS) customers and can be used by GitHub Enterprise Cloud organisations across repositories that maintain an active GHAS Code Security licence.”

Policy enforcement runs through GitHub’s existing rulesets system. GitHub explains: “The policy is activated by targeting repositories with a ruleset that uses a new ‘Require license compliance check results before merging’ condition, similar to the existing code scanning conditions.” When a pull request adds or modifies a dependency, the ruleset checks its license against policy and, depending on configuration, either flags it or blocks the merge.

Enforcement comes in two modes, according to GitHub’s documentation: an Evaluate mode ruleset “will run license checks and annotate the pull request, but not block merges,” while a ruleset in Active mode means “pull requests that introduce noncompliant dependencies are blocked until violations are resolved.” Open Source For You described the same distinction, noting organizations can roll out “organization-wide rulesets that generate pull request annotations for awareness in ‘Evaluate’ mode without blocking merges” before switching to Active mode enforcement.

License checks cover more than a project’s direct dependencies. GitHub’s documentation states: “License evaluation uses dependency data from your repositories, including transitive dependencies detected in the dependency graph.” Policy authors can allow licenses “from either a built-in list or, if a license is not listed, by manually adding a SPDX license identifier,” according to the same documentation. According to GitHub, the feature “introduces a new predefined enterprise role” for policy governance. GitHub’s documentation adds that exceptions for specific packages or licenses are routed to that role for approval.

GitHub’s own Open Source Program Office was among the feature’s first users. “GitHub’s Open Source Program Office (OSPO) uses the new GitHub License Compliance feature, now in public preview, to manage thousands of open-source dependencies and identify dependencies whose licenses require review,” Help Net Security reported. Jeff Luszcz, Staff Product Manager, and Eric Sorenson, Senior Product Manager, at GitHub, framed the rationale for the feature in comments to the outlet: “Nearly all software carries some kind of license agreement. The license gives you permission to use a project, provided you comply with its obligations.”

What We Don’t Know

GitHub has not said when License Compliance will move from public preview to general availability, nor whether it will remain bundled with GitHub Advanced Security Code Security or become a separate offering. The company also has not disclosed how many organizations have enabled the feature since the June 30 preview launch, or what portion of flagged dependencies during the Open Source Program Office’s internal use were ultimately blocked versus granted exceptions.