Summary
On October 16, 2026, GitHub moved open source license compliance to general availability. The feature adds an enterprise-wide license policy enforced through rulesets, with a 'Require license compliance results before merging' condition that checks every dependency a pull request adds or changes against acceptable licenses, flagging noncompliant ones via PR annotations.
What changed
GitHub's open source license compliance reached GA after a June public preview. It enforces an enterprise-wide license policy via rulesets (new 'Require license compliance results before merging' condition), annotates noncompliant dependencies in pull requests, and adds a predefined Enterprise Open-Source License Manager role for exception requests. Since preview it gained data-residency support (feeding the dependency graph and SBOM exports), audit-log events for policy changes, API endpoints to manage the policy, and a package-compliance check endpoint so coding agents can avoid suggesting noncompliant packages.
Why it matters
License compliance enforced in the merge path turns a manual legal review into automated policy, and the agent-facing compliance API lets AI coding assistants pre-screen dependency suggestions, extending governance over what both humans and agents are allowed to pull into a codebase.
Evidence excerpt
An enterprise-wide license policy, enforced through rulesets, adds the condition 'Require license compliance results before merging.' An API endpoint checks whether a package complies with policy, so coding agents can avoid suggesting noncompliant packages.