GitHub · Pull requests · License compliance · Checked October 26, 2026

GitHub: license compliance results block the merge

A branch ruleset can require license compliance results ("Require license compliance results before merging"). License compliance checks the dependencies a pull request adds or changes against a policy of permitted licenses, and blocks pull requests that add dependencies whose licenses are not allowed (GitHub's available rules for rulesets and about open source license compliance). Classic branch protection has no such setting; it is the ruleset rule license_compliance_scanning, which takes no parameters (checked October 26, 2026).

GET /repos/OWNER/REPO/rules/branches/BRANCH
[{ "type": "license_compliance_scanning" }]

What the rule checks

Dependency changes: when a pull request changes package manifests, GitHub compares the dependency changes between the base and pull request branches, evaluates the detected licenses against the policy, and reports violations. The evaluation uses the repository's dependency data, transitive dependencies detected in the dependency graph included.
The policy: the permitted licenses are set in an enterprise policy, picked from a built-in list or entered as SPDX license identifiers, and repository-specific exceptions can be layered on it. Developers with write access can view the policy and exceptions in effect for a repository in its settings, under "License policy" (GitHub's configuring open source license policies).
Who can use it: license compliance is available for GitHub Enterprise Cloud, including data resident GHEC. Enforcing its policy on a repository needs a GitHub Code Security license, and the dependency graph has to be enabled for the repositories evaluated.
Active or evaluate: a ruleset in Active mode with this rule blocks pull requests that introduce noncompliant dependencies until the violations are resolved; a ruleset in Evaluate mode runs the license checks and annotates the pull request, but does not block merges. "Get rules for a branch" returns only active rules, not those in rulesets that only evaluate or are disabled (GitHub's REST API endpoints for rules).

Where it shows on the pull request

Annotations: if a dependency's license is not in the policy, the findings appear in pull request annotations. They do not generate an exception request by themselves, because the developer may change the code to avoid the noncompliant dependency.
Exception requests: to use the dependency anyway, GitHub prompts the developer for more information and sends the request to the Enterprise Open Source License Managers, who see pending requests in the enterprise security views and get them as email notifications.
Conversation resolution: a branch protection rule that requires comment resolution before merging tracks the annotations from license checks, so even alerts from a ruleset in Evaluate mode are subject to it (see unresolved conversations block the merge).

What to do

A dependency's license is not allowed: update the pull request to use compliant dependencies, then push.
The dependency is needed: request an exception. An Enterprise Open Source License Manager can approve it for a package, a license or a package pattern, at repository or enterprise scope. Once it is approved, the alert is closed and the pull request is unblocked, as long as no other required checks are failing.
The license should be allowed: update the policy where appropriate. Entries set at the enterprise level cannot be edited in a repository's policy.
Annotations but no block: the ruleset is probably in Evaluate mode; only an Active ruleset blocks the merge, unless the branch also requires conversations resolved.

GitHub pull requests in IntelliJ IDEA

Pull Request Inbox for GitHub, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, shows a pull request's reviews, checks and conversations next to the diff, and merges it with the methods the target branch allows. When GitHub calls the pull request blocked, its merge checks name what they can read: required checks that have not reported, a review still required, unresolved conversations and unsigned commits the rules hold against it, the rule on the most recent push, and the code scanning tools, code quality severity and code coverage thresholds the rulesets require. When the branch's rulesets require license compliance results, the merge checks of a blocked pull request say so, with what the rule holds back and how a violation is resolved. The review inbox, diffs and conversations are free; approving, commenting, resolving and merging are Pro (US$1.50 a month, with a 30-day trial).

GitHub is a trademark of GitHub, Inc.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with or endorsed by GitHub, Inc. or JetBrains.