GitHub's New Tool for License Compliance

GitHub, the de facto home for open source, is doubling down on ensuring its own house is in order. The company's Open Source Program Office (OSPO) has transitioned to a new, built-in license compliance product designed to manage the thousands of open source dependencies woven into its platform and internal projects. This move aims to streamline the complex process of respecting the licenses that govern the code it relies on.

Software licenses, from permissive MIT to copyleft GPL, dictate how code can be used, modified, and distributed. For companies like GitHub, which operate on a massive scale and often build proprietary products, adhering to these terms is critical to avoid legal battles and reputational damage. Traditionally, this has involved manual reviews or third-party solutions.

Automating the Compliance Gauntlet

The new feature, available to GitHub Advanced Security customers, integrates license review directly into the pull request workflow. When new dependencies are introduced, the tool automatically scans their licenses against predefined organizational policies.

This proactive approach allows developers to address potential license conflicts early. GitHub's OSPO, acting as early adopters, helped refine the feature, ensuring it could handle the scale and complexity required by large enterprises.

The process begins with defining an initial policy, often seeded with common permissive licenses like MIT, Apache 2.0, and BSD-3-Clause. Initially deployed in an 'Evaluate' mode, the tool generated alerts without blocking merges, allowing teams to acclimate to the new workflow.

Policy Flexibility and Review

Under the hood, license compliance checks are managed via rulesets. These can be applied to specific repositories or broadly across an organization, with modes for evaluation or active enforcement.

When a pull request introduces dependencies with non-compliant licenses, the tool flags them directly in the pull request. Developers can then choose to update their code or remove the dependency.

For dependencies that warrant an exception, developers can initiate a review request. This notification system routes the request to a dedicated license policy team, comprising OSPO members and legal experts.

This team, distributed across time zones for timely reviews, makes decisions on whether to permit a specific license or package. Permissions can be granted at the enterprise level for widely accepted licenses or at the repository level for more specific commercial agreements.

The system also supports wildcard matches for package exceptions, simplifying the management of internal libraries or scoped namespaces. This ensures that developers can efficiently integrate necessary components while maintaining robust governance.