What changed
On October 16, 2026 GitHub made open-source licence compliance generally available for GitHub Enterprise Cloud customers, including data-resident tenants, on repositories with GitHub Code Security enabled. Enterprise policies can be attached through a ruleset condition requiring licence-compliance results before merging pull requests that add or change dependencies. The GA release also adds a specialised licence-manager role, approval workflow, audit events, API policy management and an API to check whether a package complies before adoption.
Why it matters
Organisations that ship software with third-party packages can enforce legal licence boundaries at the same point they enforce code quality and security. The package-compliance endpoint matters for coding agents that suggest or install dependencies without understanding organisation policy. Teams must still evaluate licences and exceptions correctly; automated metadata cannot decide every legal question, and this is a paid Enterprise Cloud/Code Security capability rather than a universal GitHub feature.
A central policy can block merges
Administrators define acceptable licences and attach the new `Require license compliance results before merging` condition to repository rulesets. GitHub evaluates newly added or changed dependencies on pull requests and annotates noncompliant packages. Developers must remove/replace the package, amend policy or request an exception before the merge can proceed.
Policy managers and auditability
A new `Enterprise Open-Source License Manager` role can review and approve exception/closure requests. GitHub sends notifications to policy managers, emits audit-log events for policy changes and supports downloading, replacing and updating policies via REST endpoints. Data-residency customers now receive licence metadata in dependency graphs and SBOM exports.
Coding agents can ask before adding a package
The new package-compliance API lets a coding agent or internal dependency-selection service check candidate packages against enterprise policy before generating a pull request. This shifts compliance left from rejection at merge to prevention during package choice. Teams still need to protect API credentials and handle policy exceptions, package metadata gaps and transitive dependencies.
Who can use it and what remains uncertain
The GA feature requires GitHub Enterprise Cloud and enabled GitHub Code Security on targeted repositories. GitHub's existing dependency-review action is a related but different capability. The June 2026 public preview is not the GA launch date; policy behaviour, rule coverage and legal interpretation should be tested on representative dependency changes before broad enforcement.