GitHub Copilot handles this as a draft: GitHub's 16 Oct 2026 changelog says a new API lets coding agents check whether packages comply with an enterprise license policy, so they can avoid recommending or adding a package that violates it. You still add the dependency.
The changelog says open source license compliance is generally available for GitHub Enterprise Cloud customers, including data-resident Enterprise Cloud, for repositories with GitHub Code Security enabled. A ruleset uses the condition Require license compliance results before merging.
The changelog says there is a new API endpoint for checking whether packages comply with policy, so coding agents can avoid recommending or incorporating packages that violate the organization's license usage policy. It points to the REST API endpoints for the dependency graph and does not name the path in the announcement. If the agent cannot show a real result, do not add the package.
You add, replace, or skip the dependency. Noncompliant annotations on a pull request are addressed by removing or replacing the dependency, amending the policy, or creating a package exception. Those calls stay with a person. The changelog names an Enterprise Open-Source License Manager role for reviewing closure requests.
These are editorial labels so you can compare playbooks. They are not measurements.
No. Status is unverified. The changelog was checked on 18 Oct 2026. The prompt is an adaptation, and the announcement does not print the API path.
Adding the dependency, changing the policy, and creating a package exception. The changelog says noncompliant annotations have to be addressed in one of those ways.
GitHub Changelog, 16 Oct 2026, by Allison. The page returned HTTP 200 on 18 Oct 2026. Open source license compliance is generally available for GitHub Enterprise Cloud, including data-resident GHEC, on repositories with GitHub Code Security. It describes the ruleset condition, pull request annotations, the Enterprise Open-Source License Manager role, and a new API endpoint so coding agents can check package compliance. The announcement says coding agents, not only GitHub Copilot. Using Copilot for the check is an AI Playbook Gems adaptation. Prompt and stop rules are not a vendor quote; unverified.
Machine-readable copy: JSON
GitHub Copilot handles this as a draft: Copilot CLI pre-release 1.0.100-1, published 16 Oct 2026, makes the unified Sessions browser the default for /sessions, /session, and /resume. You confirm it opened the session you meant before it edits anything.
GitHub Copilot · Unverified · github.com · 18 Oct 2026