Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is now generally available for GitHub Enterprise Cloud customers, including data-resident GHEC, for repositories with GitHub Code Security enabled.

Open source license compliance expands on the capabilities of the dependency review action by introducing an enterprise-wide license policy. The policy is activated by targeting repositories with a ruleset that uses a new Require license compliance results before merging condition, similar to the existing code scanning conditions. When developers open pull requests that add or modify dependencies, license checks automatically ensure each new or changed dependency has an acceptable license. The feature annotates the pull request with a message about each noncompliant dependencies. These annotations must be addressed by removing or replacing the dependency, amending the license policy, or creating package exceptions.

Open source license compliance introduces a new predefined enterprise role, Enterprise Open-Source License Manager. Assign this role to individuals or teams who should review and approve closure requests. Policy managers receive email notifications about pending requests and can review them from the enterprise console.

Since the public preview release in June, we’ve made several improvements:

• License information is now available for GitHub Enterprise Cloud data residency customers. This not only enables the license compliance feature, but also populates the dependency graph and Software Bill of Materials (SBOM) exports with license data.
• License policy changes now emit audit log events, for integration with external systems of record.
• There are new API endpoints for downloading, updating, and replacing the enterprise license policy.
• There is also a new API endpoint for checking whether packages comply with policy. This enables coding agents to avoid recommending or incorporating packages which violate an organization’s license usage policy.

For detailed setup instructions, see About open source license compliance.

For information about API endpoints see REST API endpoints for dependency-graph

Join the discussion within GitHub Community.