GitHub's open source licence compliance tool reaches GA
GitHub Enterprise Cloud can now block pull requests over non-compliant dependency licences, with a dedicated review role and an API coding agents can query before adding a package.
GitHub’s open source licence compliance feature reached general availability on 16 October, for GitHub Enterprise Cloud customers running GitHub Code Security, including data-resident GHEC instances. It has been in preview since June, and lets an organisation set a licence policy once and enforce it through rulesets everywhere.
Pull requests that add or change a dependency now get flagged automatically when its licence does not match policy. A new “Enterprise Open-Source License Manager” role handles exception requests, and GitHub added audit log events for policy changes plus REST endpoints for downloading, updating and replacing a policy. The more interesting addition is a compliance-check endpoint built so a coding agent can look up a package’s licence before it suggests adding the dependency, rather than after.
Why it matters: licence compliance has mostly meant someone running a scanner periodically and chasing down answers after the fact. Turning it into a PR-time gate, backed by an API a coding agent can query first, catches a licence problem before the dependency lands rather than after a release ships with it.