# GitHub makes enterprise licence compliance a pull-request merge gate — with an API for coding agents GitHub's October 16 general release lets Enterprise Cloud organisations enforce dependency-licence policy before merge, approve exceptions and query compliance programmatically. It requires GitHub Code Security and is not a feature of ordinary free repositories. A new GitHub ruleset can stop unapproved dependency licences at merge time, and agents can check packages before recommending them. - Status: Active - Published: 2026-10-17T14:53:22+13:00 - Updated: 2026-10-17T14:53:22+13:00 - Categories: Web Development, Cloud & Infrastructure, Deployment & DevOps, Developer Tools - Tags: GitHub, open source, supply chain security - Canonical HTML: https://beyondthe.news/dossiers/github-enterprise-open-source-license-compliance-ga-rulesets-agent-api-2026 ## What changed On October 16, 2026 GitHub made open-source licence compliance generally available for GitHub Enterprise Cloud customers, including data-resident tenants, on repositories with GitHub Code Security enabled. Enterprise policies can be attached through a ruleset condition requiring licence-compliance results before merging pull requests that add or change dependencies. The GA release also adds a specialised licence-manager role, approval workflow, audit events, API policy management and an API to check whether a package complies before adoption. ## Why it matters Organisations that ship software with third-party packages can enforce legal licence boundaries at the same point they enforce code quality and security. The package-compliance endpoint matters for coding agents that suggest or install dependencies without understanding organisation policy. Teams must still evaluate licences and exceptions correctly; automated metadata cannot decide every legal question, and this is a paid Enterprise Cloud/Code Security capability rather than a universal GitHub feature. ## A central policy can block merges Administrators define acceptable licences and attach the new `Require license compliance results before merging` condition to repository rulesets. GitHub evaluates newly added or changed dependencies on pull requests and annotates noncompliant packages. Developers must remove/replace the package, amend policy or request an exception before the merge can proceed. ## Policy managers and auditability A new `Enterprise Open-Source License Manager` role can review and approve exception/closure requests. GitHub sends notifications to policy managers, emits audit-log events for policy changes and supports downloading, replacing and updating policies via REST endpoints. Data-residency customers now receive licence metadata in dependency graphs and SBOM exports. ## Coding agents can ask before adding a package The new package-compliance API lets a coding agent or internal dependency-selection service check candidate packages against enterprise policy before generating a pull request. This shifts compliance left from rejection at merge to prevention during package choice. Teams still need to protect API credentials and handle policy exceptions, package metadata gaps and transitive dependencies. ## Who can use it and what remains uncertain The GA feature requires GitHub Enterprise Cloud and enabled GitHub Code Security on targeted repositories. GitHub's existing dependency-review action is a related but different capability. The June 2026 public preview is not the GA launch date; policy behaviour, rule coverage and legal interpretation should be tested on representative dependency changes before broad enforcement. ## Key details - October 16, 2026 general availability after June public preview. - Requires GitHub Enterprise Cloud (including data residency) and GitHub Code Security. - New ruleset condition: `Require license compliance results before merging`. - Noncompliant dependencies receive PR annotations; exceptions can be reviewed. - Dedicated Enterprise Open-Source License Manager role and policy audit events. - New REST APIs manage policies and check individual package compliance. ## Builder takeaways - Confirm your organisation has both the Enterprise Cloud and Code Security entitlements. - Pilot the licence ruleset in representative repositories and define exception ownership. - Have coding agents query compliance before selecting new dependencies. - Audit dependency metadata, SBOMs and transitive packages; avoid treating a green check as legal advice. - Preserve policy changes and exception decisions in audit records. ## What to watch - API/tool integration into coding agents and dependency bots. - Coverage of transitive dependencies and unusual or dual-licensed packages. - False positives, exception workflow reliability and policy management overhead. - Potential future availability outside Enterprise Cloud. ## Uncertainties - No independent broad deployment evidence yet for accuracy and false-positive rates. - Licensing metadata and legal interpretation may be ambiguous for some packages. - Pricing is bundled in paid entitlements rather than a standalone universal free feature. ## Sources - [Open source license compliance generally available](https://github.blog/changelog/2026-10-16-open-source-license-compliance-generally-available) — GitHub Changelog · primary · 2026-10-16T00:00:00+13:00. GA scope, ruleset condition, new role and API changes. - [About open source license compliance](https://docs.github.com/en/enterprise-cloud@latest/code-security/concepts/supply-chain-security/open-source-license-compliance) — GitHub Docs · primary. Eligibility, enforcement and compliance workflow.