GitHub makes open source license compliance generally available for Enterprise Cloud
Victoria Shinder2 min readGitHub announced on 16 October 2026 that open source license compliance is generally available for GitHub Enterprise Cloud customers, including those on data-resident GHEC. It applies to repositories that have GitHub Code Security enabled. The feature was in public preview since June.
How it works. The feature builds on the dependency review action, but adds a single license policy for the whole enterprise. The policy is switched on by targeting repositories with a ruleset that uses a new condition, "Require license compliance results before merging", which works like the existing code scanning conditions. When a pull request adds or changes dependencies, each new or changed dependency is checked against the policy, and the pull request is annotated with a message for every dependency that does not comply.
Those annotations block the merge until they are dealt with in one of three ways: the dependency is removed or replaced, the license policy itself is amended, or an exception for the package is created. Exceptions go through a closure request. GitHub adds a new predefined role, Enterprise Open-Source License Manager, for the people or teams who review and approve those requests; policy managers get email notifications about pending requests and handle them from the enterprise console.
What changed since the preview.
- License data for data residency. GHEC customers with data residency now get license information. That enables the compliance feature and also fills in license data in the dependency graph and in SBOM exports.
- Audit log. Changes to the license policy now emit audit-log events, so they can be fed into external systems of record.
- Policy API. New REST endpoints download, update and replace the enterprise license policy.
- Compliance check API. A further endpoint checks whether given packages comply with the policy. GitHub says this lets coding agents avoid recommending or adding packages that violate an organisation's license policy.
The changelog points to the documentation page "About open source license compliance" for setup and to the dependency-graph REST endpoints for the API. It does not give pricing beyond the requirement for Code Security, and it does not say whether the feature will come to GitHub Enterprise Server.
Source: GitHub Changelog, "Open source license compliance generally available" — https://github.blog/changelog/2026-10-16-open-source-license-compliance-generally-available