GitHub has announced the general availability of Open Source License Compliance for GitHub Enterprise Cloud customers, including data-resident GHEC, for repositories with GitHub Code Security enabled.
This feature adds an enterprise-wide license policy on top of the existing dependency review workflow, centralizing governance over which licenses are acceptable.
- Enforces a centralized policy via rulesets
- Annotates pull requests with licensing noncompliance for each affected dependency
GOVERNANCE AND AUTOMATION IN PRACTICE
The policy is activated by targeting repositories with a ruleset that uses a new license-compatibility condition, aligning with how code scanning conditions work today.
A new enterprise role, Enterprise Open-Source License Manager, exists to assign responsibility for policy review and closure requests.
- Centralized license governance across repositories
- Role-based review and approval workflow
HOW IT AFFECTS DAY-TO-DAY DEVELOPMENT
When developers open pull requests that add or modify dependencies, license checks automatically ensure each new or changed dependency has an acceptable license.
Noncompliant dependencies trigger PR annotations and must be addressed by remediation actions such as removal, replacement, policy amendments, or package exceptions.
- PRs gated by license policy
- Remediation options to maintain compliance
POLICY MANAGEMENT AND VISIBILITY
There are new API endpoints for downloading, updating, and replacing the enterprise license policy, and for checking whether packages comply with policy.
Policy changes emit audit log events to support integration with external systems of record.
- Automation-friendly policy management
- Audit trails for governance
WHAT WE CAN AND CANNOT CONCLUDE FROM THE EVIDENCE
The available sources confirm general availability and outline governance mechanics, but do not provide pricing, rollout timelines beyond the stated GA status, or user-experience specifics beyond the described annotations and remediation steps.
RELATED COVERAGE
- Claude Haiku 5.5 becomes generally available in GitHub Copilot, aimed at fast subagent and editing tasks
- GitHub completes staged rollout of stateless App installation tokens, with longer token format and unchanged permissions
- GitHub Copilot adds general availability for local sandboxing across CLI, app, and VS Code
- GitLab Duo CLI Brings Agentic Chat to the Terminal
- Developer Tools articles
SOURCES
- Archive: 2026 - GitHub Changelog: Open source license compliance generally available Published · Primary source
