{"slug":"github-copilot-check-a-package-against-the-license-policy","title":"Check a package against the license policy before it is added","summary":"GitHub Copilot handles this as a draft: GitHub's 16 Oct 2026 changelog says a new API lets coding agents check whether packages comply with an enterprise license policy, so they can avoid recommending or adding a package that violates it. You still add the dependency.","agent":"GitHub Copilot","agentSlug":"github-copilot","category":"Coding","categorySlug":"coding","roles":["Software engineer","Engineering manager"],"roleSlugs":["software-engineer","engineering-manager"],"industries":["Software"],"industrySlugs":["software"],"jobs":["shipping-code"],"topic":"Dev & Coding","topicSlug":"dev-and-coding","score":19,"difficulty":"medium","estCost":"GitHub Enterprise Cloud, including data-resident Enterprise Cloud, on a repository with GitHub Code Security enabled. The changelog does not list a dollar price. It is not an individual Free-plan feature.","costTier":"high","timeSaved":"A dependency check before a pull request adds a package the policy would later annotate. An estimate, not a measurement.","prompt":"I am about to add one package. Check it against this organization's enterprise license policy before you recommend it or edit a manifest.\n\nUse the API endpoint GitHub documents for checking whether packages comply with the license policy (the dependency-graph REST API, as the 16 Oct 2026 changelog describes it). Quote the result you actually got. If you cannot find that endpoint, or the call fails, stop and say so. Do not guess that a license is allowed.\n\nIf the package does not comply, do not add it. Do not change the license policy. Do not create a package exception. Do not open a pull request.\n\nReturn the package name, the compliance result, and the one decision I still have to make.","steps":[{"title":"Confirm the enterprise policy is on","detail":"The changelog says open source license compliance is generally available for GitHub Enterprise Cloud customers, including data-resident Enterprise Cloud, for repositories with GitHub Code Security enabled. A ruleset uses the condition Require license compliance results before merging."},{"title":"Ask the agent to check one package and read the result","detail":"The changelog says there is a new API endpoint for checking whether packages comply with policy, so coding agents can avoid recommending or incorporating packages that violate the organization's license usage policy. It points to the REST API endpoints for the dependency graph and does not name the path in the announcement. If the agent cannot show a real result, do not add the package."},{"title":"Stop","detail":"You add, replace, or skip the dependency. Noncompliant annotations on a pull request are addressed by removing or replacing the dependency, amending the policy, or creating a package exception. Those calls stay with a person. The changelog names an Enterprise Open-Source License Manager role for reviewing closure requests."}],"sourceUrl":"https://github.blog/changelog/2026-10-16-open-source-license-compliance-generally-available/","sourceNote":"GitHub Changelog, 16 Oct 2026, by Allison. The page returned HTTP 200 on 18 Oct 2026. Open source license compliance is generally available for GitHub Enterprise Cloud, including data-resident GHEC, on repositories with GitHub Code Security. It describes the ruleset condition, pull request annotations, the Enterprise Open-Source License Manager role, and a new API endpoint so coding agents can check package compliance. The announcement says coding agents, not only GitHub Copilot. Using Copilot for the check is an AI Playbook Gems adaptation. Prompt and stop rules are not a vendor quote; unverified.","date":"2026-10-18","verified":false,"status":"unverified","sponsorUrl":"","metrics":[{"label":"Hands-on time","value":"Reading one compliance result before a manifest edit"},{"label":"You still approve","value":"Adding the package, or asking for an exception"}],"faq":[{"question":"Has this GitHub Copilot playbook been re-run for the catalog?","answer":"No. Status is unverified. The changelog was checked on 18 Oct 2026. The prompt is an adaptation, and the announcement does not print the API path."},{"question":"What stays human?","answer":"Adding the dependency, changing the policy, and creating a package exception. The changelog says noncompliant annotations have to be addressed in one of those ways."}],"url":"https://aiplaybookgems.com/usecases/github-copilot-check-a-package-against-the-license-policy","jsonUrl":"https://aiplaybookgems.com/api/usecases/github-copilot-check-a-package-against-the-license-policy"}