GitHub Open Source License Compliance Now Generally Available

Disclosure: this post contains affiliate links. If you buy through them we may earn a commission at no extra cost to you. Learn more.

TL;DR: GitHub has made its open source license compliance feature generally available for GitHub Enterprise Cloud customers with GitHub Code Security enabled. The feature allows enterprises to manage dependency licenses at scale through ruleset-based checks that enforce centralized policies, automatically flagging noncompliant dependencies in pull requests.

What's New

GitHub has announced the general availability of its open source license compliance feature for GitHub Enterprise Cloud customers, including data-resident GHEC, for repositories with GitHub Code Security enabled. This release enables enterprises to manage their dependencies' licenses at scale using sophisticated, ruleset-based checks that enforce a centralized policy.

The feature expands on the capabilities of the dependency review action by introducing an enterprise-wide license policy. Organizations activate the policy by targeting repositories with a ruleset that uses a new "Require license compliance results before merging" condition, similar to existing code scanning conditions.

When developers open pull requests that add or modify dependencies, license checks automatically ensure each new or changed dependency has an acceptable license. The feature annotates pull requests with messages about noncompliant dependencies, which must be addressed by removing or replacing the dependency, amending the license policy, or creating package exceptions.

Since the public preview release in June, GitHub has made several improvements to the feature. License information is now available for GitHub Enterprise Cloud data residency customers, which not only enables the license compliance feature but also populates the dependency graph and Software Bill of Materials (SBOM) exports with license data.

License policy changes now emit audit log events for integration with external systems of record. New API endpoints have been added for downloading, updating, and replacing the enterprise license policy. An additional API endpoint allows checking whether packages comply with policy, enabling coding agents to avoid recommending or incorporating packages that violate an organization's license usage policy.

The feature introduces a new predefined enterprise role called "Enterprise Open-Source License Manager." Organizations can assign this role to individuals or teams who should review and approve closure requests. Policy managers receive email notifications about pending requests and can review them from the enterprise console.

Pricing and Availability

Open source license compliance is now generally available for GitHub Enterprise Cloud customers, including data-resident GHEC. The feature requires repositories to have GitHub Code Security enabled. Specific pricing details were not disclosed in the announcement.

How to Try It

GitHub has published detailed setup instructions in its documentation under "About open source license compliance." Information about the new API endpoints is available in the REST API endpoints for dependency-graph documentation.

Organizations can join the discussion about the feature within GitHub Community to share feedback and learn from other users' experiences.

Who It's For

This feature is designed for enterprise organizations that need to maintain strict control over the open source licenses used in their software dependencies. It's particularly valuable for companies in regulated industries, those with specific legal requirements around open source usage, or organizations that want to prevent inadvertent inclusion of incompatible licenses in their codebases.

Development teams, compliance officers, legal departments, and open source program offices will benefit from the automated enforcement and centralized policy management capabilities. The new Enterprise Open-Source License Manager role enables organizations to designate specific individuals or teams responsible for license policy oversight.

Alternatives

Organizations looking for dependency and compliance management solutions might also consider platforms like Snyk, WhiteSource (now Mend), or FOSSA for license compliance and software composition analysis. However, GitHub's native integration with its existing code security and dependency management features provides a streamlined experience for teams already using GitHub Enterprise Cloud.

For teams working on automation workflows that might integrate with license compliance checks, Make could help connect GitHub's new API endpoints with other tools in their development and compliance stack.