GitHub license compliance GA: manage the lifetime of exceptions
A dependency update with no security alerts has not necessarily cleared license review. A green license check, meanwhile, does not establish that every way your product is distributed has been assessed. GitHub announced general availability of open source license compliance on October 16, 2026. The useful engineering question is how to connect its decision to a durable record of what the team actually approved.
Check eligibility and targeting first
The announcement covers GitHub Enterprise Cloud, including data-resident environments, for repositories with GitHub Code Security enabled. Do not infer automatic availability for every Free or Team repository. An enterprise policy is targeted through a ruleset using Require license compliance results before merging. Verify your account's eligibility, the repositories targeted and the effective merge condition separately. A policy saved in an administration screen is only one part of that chain. Active mode blocks merges; Evaluate mode annotates without that block. A separate branch protection requirement to resolve comments can still make annotations affect merging, so inspect that interaction too.
Understand the unit being checked
When a pull request adds or modifies dependencies, the check evaluates new or changed dependencies against acceptable licenses in the policy. Noncompliant packages are annotated on the PR. Responses include removing or replacing a dependency, changing policy or creating a package exception. That scope is not a declaration that all previously shipped software has been reviewed. Ask which package version and change were evaluated under which policy. The workflow suggestions below are editorial interpretation, distinct from GitHub's feature description.
Give exceptions an owner and a review trigger
The Enterprise Open-Source License Manager role provides a way to assign people who review and approve closure requests. A team can additionally record package and version, related PR, intended use, rationale, owner and next review trigger. For example, approval for a demo should prompt another review when that dependency enters a customer deliverable. This is a proposed team process, not a claim that GitHub automatically expires exceptions. The purpose is to stop a temporary decision from silently becoming a permanent assumption.
Check before an agent chooses a package
The release also introduces an API for checking package compliance and audit events for policy changes. A check before an agent installs a dependency could reduce later replacement work. Record what package and policy were checked, when, and the result alongside the proposed change, rather than merely noting that an API responded. Failed requests or unknown license information should be routed to review instead of silently treated as permission. A prior response must also be understood in the context in which it was obtained.
Start with two small test PRs: one using an accepted dependency and another intentionally outside policy. Observe annotations and merge enforcement, then inspect the record left after an exception is approved. Use a test repository that does not alter customer code. If the rule conflicts with existing CI, establish an owner and rollback procedure before expanding organization-wide. This is a proposed validation exercise; we have not run it against a customer's enterprise configuration or measured its effectiveness.
For teams evaluating the rollout, the practical question is who owns an exception and what future change causes it to be reviewed again. The announcement links to a community discussion, but this article makes no claim about participation or adoption. Tool output supports a review process; this operational explanation does not determine the legal meaning of an individual license. On your next dependency PR, preserve the reasoning and the review trigger together with the package change.
Sources and verification scope
GitHub Docs · Open source license compliance
Checked the official release announcement on October 17, 2026. Confirm current documentation and settings in your own account.