Open Source License Compliance is in public preview

[ahpook]

🏷️ Discussion Type

Product Feedback

💬 Feature/Topic Area

Supply chain security

Discussion Details

Let us know if you've tried out the new Open Source License Compliance feature: https://github.blog/changelog/2026-06-30-open-source-license-compliance-is-in-public-preview/

Docs are here: https://docs.github.com/en/enterprise-cloud@latest/code-security/concepts/supply-chain-security/open-source-license-compliance

[mlawsonhazen]

Is there, or will there be plans to include a tool that also generates a disclosure page for licenses that require disclosure? For example, so we have a web application that uses two or three different API tiers, we would want to have a web page depicting the required disclosures based on the direct and transient licenses for all of the tiers. Ideally, we would build these a CI time and add them as standard HTML to the web app.

If not, could this become a feature request? I'd like to avoid going down an external commercial product if we can avoid it.

[ahpook]

It's a good question - we're looking at things like this for the next part of the product, which is more of a baseline report-and-audit capability. So copyright attribution and license text is a part of that. There do seem to be a lot of free solutions too, though - have you looked at doing this through an Action ? Like https://github.com/marketplace/actions/generate-licenses-md-from-sbom or https://github.com/sassoftware/sbom-to-notices

[IchordeDionysos]

Hey,

I've reached out regarding Pub dependencies having no license associated.

I saw that you reworked how you fetch license information and listed Pub there.

Now checking our dependencies and saw that a lot of them still don't have licenses associated.
Some do but not all.

Other interesting insight, they show the license in a strange way mit vs MIT as it's unusually written.
Though that's a minor thing.

[ahpook]

Hi @IchordeDionysos is one of the repos that you are seeing this publicly visible?