Open Source License Compliance Now Generally Available for GitHub Enterprise Cloud

What changed?

GitHub has made its open source license compliance feature generally available to all GitHub Enterprise Cloud (GHEC) customers, including those with data residency requirements, for repositories with GitHub Code Security enabled. The release includes new API endpoints for managing enterprise license policies and checking package compliance. Enterprises can now enforce centralized license checks on pull requests that introduce or change dependencies. The feature provides automated annotations for noncompliant dependencies, introduces a new compliance-focused enterprise role, and emits audit log events for policy changes.

Why does it matter to an everyday developer?

Developers working within organizations that use GitHub Enterprise Cloud may now encounter automated license checks as part of their pull request workflow. These checks can identify and block the merging of dependencies with noncompliant licenses, reducing legal and operational risks. Developers benefit from clarity on license acceptance criteria, immediate feedback on problematic packages, and structured exceptions management. The functionality also enables compliance reporting for SBOM and external auditing.

What can the developer do now?

If your organization enables this feature, expect license compliance results as a condition before merges, similar to code scanning checks. Developers should review dependency additions or updates in pull requests for license issues and address flagged issues by replacing or seeking exceptions for noncompliant packages. Policy managers and designated compliance reviewers can access new APIs and UI features to manage license policy, review exceptions, and integrate with external auditing or inventory tools.