GitHub Enterprise Cloud has moved open source license compliance from preview to general availability, exposing a ruleset‑driven check that blocks merges when added or changed dependencies violate a centrally defined license policy. Teams that already use GitHub Code Security can now rely on the same platform to enforce licensing rules at scale, reducing manual review effort and improving supply‑chain governance.
How the feature works
The new capability extends the existing dependency‑review action by adding a Require license compliance results before merging condition to a repository ruleset. When a pull request introduces a dependency, GitHub automatically evaluates the license against the enterprise policy and annotates the PR with any non‑compliant packages. Authors must either replace the dependency, adjust the policy, or request an exception before the merge can proceed. A predefined role, Enterprise Open‑Source License Manager, is introduced for reviewing and approving such exception requests.
Operational impact
Policy changes generate audit‑log events, enabling integration with external record‑keeping systems. New REST endpoints allow downloading, updating, and replacing the enterprise license policy, as well as checking individual packages for compliance. License data is now populated for data‑resident GitHub Enterprise Cloud customers, enriching the dependency graph and SBOM exports. Email notifications alert policy managers to pending exception requests, and the enterprise console provides a centralized view for approval workflows.
Security and compliance considerations
By automating license checks, organizations can reduce the risk of unintentionally incorporating restricted or incompatible open‑source components. The role‑based assignment of the License Manager ensures that only authorized personnel can approve exceptions, preserving policy integrity. Audit‑log visibility supports forensic analysis and demonstrates compliance to auditors. However, teams must still maintain an up‑to‑date license policy and monitor exception requests to avoid policy drift.
Related CloudNinjas coverage: hands-on guides.
What This Means For Practitioners
Enable GitHub Code Security on your repositories, then add a ruleset that includes the Require license compliance results before merging condition. Assign the Enterprise Open‑Source License Manager role to the team responsible for open‑source governance. Use the new API endpoints to integrate compliance checks into CI pipelines or custom tooling, and monitor audit logs for policy changes. Regularly review SBOM exports to verify that license data is correctly captured across all dependencies.