开源许可证合规功能正式全面推出

企业现在可以通过复杂的、基于规则集的检查，在大规模管理依赖项许可证的同时执行集中式策略。开源许可证合规功能现已面向启用了 GitHub Code Security 的 GitHub Enterprise Cloud 客户正式全面推出，包括数据驻留版 GHEC 的仓库。

开源许可证合规功能扩展了 dependency review action 的能力，引入企业范围的许可证策略。该策略可通过规则集指定目标仓库，并使用新的 Require license compliance results before merging 条件启用，其方式类似于现有的代码扫描条件。当开发者创建添加或修改依赖项的拉取请求时，许可证检查会自动确保每个新增或变更的依赖项都具有可接受的许可证。该功能会在拉取请求中针对每个不合规依赖项添加消息注释。要解决这些注释，开发者必须移除或替换该依赖项、修改许可证策略，或创建软件包例外。

开源许可证合规功能引入了一个新的预定义企业角色：Enterprise Open-Source License Manager。请将该角色分配给应负责审查和批准关闭请求的个人或团队。策略管理者会收到有关待处理请求的电子邮件通知，并可在企业控制台中进行审查。

自 6 月发布公开预览版以来，我们进行了多项改进：

• GitHub Enterprise Cloud 数据驻留客户现在可以获取许可证信息。这不仅启用了许可证合规功能，也会在依赖关系图和软件物料清单（SBOM）导出中填充许可证数据。
• 许可证策略变更现在会生成审计日志事件，以便与外部记录系统集成。
• 新增了用于下载、更新和替换企业许可证策略的 API 端点。
• 还新增了一个用于检查软件包是否符合策略的 API 端点。这使编程 Agent 能够避免推荐或纳入违反组织许可证使用策略的软件包。

如需详细设置说明，请参阅关于开源许可证合规。

如需了解 API 端点信息，请参阅依赖关系图 REST API 端点

欢迎在 GitHub Community 中参与讨论。

Enterprises can now manage their dependencies’ licenses at scale with sophisticated, ruleset-based checks that enforce a centralized policy. Open source license compliance is now generally available for GitHub Enterprise Cloud customers, including data-resident GHEC, for repositories with GitHub Code Security enabled.

Open source license compliance expands on the capabilities of the dependency review action by introducing an enterprise-wide license policy. The policy is activated by targeting repositories with a ruleset that uses a new Require license compliance results before merging condition, similar to the existing code scanning conditions. When developers open pull requests that add or modify dependencies, license checks automatically ensure each new or changed dependency has an acceptable license. The feature annotates the pull request with a message about each noncompliant dependencies. These annotations must be addressed by removing or replacing the dependency, amending the license policy, or creating package exceptions.

Open source license compliance introduces a new predefined enterprise role, Enterprise Open-Source License Manager. Assign this role to individuals or teams who should review and approve closure requests. Policy managers receive email notifications about pending requests and can review them from the enterprise console.

Since the public preview release in June, we’ve made several improvements:

• License information is now available for GitHub Enterprise Cloud data residency customers. This not only enables the license compliance feature, but also populates the dependency graph and Software Bill of Materials (SBOM) exports with license data.
• License policy changes now emit audit log events, for integration with external systems of record.
• There are new API endpoints for downloading, updating, and replacing the enterprise license policy.
• There is also a new API endpoint for checking whether packages comply with policy. This enables coding agents to avoid recommending or incorporating packages which violate an organization’s license usage policy.

For detailed setup instructions, see About open source license compliance.

For information about API endpoints see REST API endpoints for dependency-graph

Join the discussion within GitHub Community.