GitHub ships a licence API so coding agents stop pulling blocked packages

A coding agent on GitHub Enterprise Cloud can now ask the policy whether a package is allowed before it writes the dependency into the code. GitHub shipped the API endpoint that answers today, alongside the general availability of its open source license compliance feature.

GitHub says the feature is now generally available for GitHub Enterprise Cloud customers, including the data-resident GHEC product, that have GitHub Code Security enabled on their repositories. The release note is dated 16 October 2026 and names June 2026 as the start of the public preview the GA replaces.

The three places a licence can now be blocked

The feature adds a new ruleset condition, Require license compliance results before merging, modelled on GitHub's existing code-scanning conditions. When a pull request changes dependencies, GitHub checks each new or changed one against a centrally managed policy and annotates the pull request with a message on each non-compliant item. GitHub lists three ways to resolve the alert: remove or replace the dependency, amend the policy, or create a package exception.

For the agent flow, GitHub shipped a new API endpoint for checking whether a package complies with the policy. The release note says this "enables coding agents to avoid recommending or incorporating packages which violate an organization's license usage policy", so an agent that reads the API never writes a blocked dependency into the branch at all. The ruleset still catches a package that gets added by hand, and the policy still catches a change in the policy itself.

The approver role

GitHub also added a predefined enterprise role, Enterprise Open-Source License Manager, that reviews and approves exception requests. Policy managers in that role receive email notifications about pending requests and work them from the enterprise console, with no wider admin role needed to clear one.

What the GA added over the preview

GitHub lists three changes since June. License data now populates the dependency graph and Software Bill of Materials exports for GHEC data-residency customers. Policy changes emit audit log events, so a company with an external audit store can read a trail of who changed the policy and when. And the REST API grew endpoints for downloading, updating and replacing an enterprise's license policy, which turns the policy itself into something a build pipeline can own.

What the release note does not say

GitHub does not state a price, so the feature follows the pricing of GitHub Code Security on GitHub Enterprise Cloud. The release note does not list the licence detections the check uses or how often they are updated, and it does not say how the API endpoint behaves on a package the dependency graph has not yet seen. The post has no byline.

The read for an enterprise shipping with AI assistants

Teams that gave a coding agent permission to open pull requests have been running one of two patterns on licences: a human reviewer who catches the problem on the pull request, or a build-break that catches it later. Both find a licence violation after the agent has written the code, which is the costly moment. A policy that a coding agent reads before it writes the dependency moves the check to the point of the choice, so the agent picks a package that already fits, and the pull-request ruleset catches a human-added package that does not.

Source

• Open source license compliance generally available, GitHub Changelog
• About open source license compliance, GitHub Docs