Open Source License Compliance is in public preview

[ahpook]

🏷️ Discussion Type

Product Feedback

💬 Feature/Topic Area

Supply chain security

Discussion Details

Let us know if you've tried out the new Open Source License Compliance feature: https://github.blog/changelog/2026-06-30-open-source-license-compliance-is-in-public-preview/

Docs are here: https://docs.github.com/en/enterprise-cloud@latest/code-security/concepts/supply-chain-security/open-source-license-compliance

[mlawsonhazen]

Is there, or will there be plans to include a tool that also generates a disclosure page for licenses that require disclosure? For example, so we have a web application that uses two or three different API tiers, we would want to have a web page depicting the required disclosures based on the direct and transient licenses for all of the tiers. Ideally, we would build these a CI time and add them as standard HTML to the web app.

If not, could this become a feature request? I'd like to avoid going down an external commercial product if we can avoid it.

[ahpook]

It's a good question - we're looking at things like this for the next part of the product, which is more of a baseline report-and-audit capability. So copyright attribution and license text is a part of that. There do seem to be a lot of free solutions too, though - have you looked at doing this through an Action ? Like https://github.com/marketplace/actions/generate-licenses-md-from-sbom or https://github.com/sassoftware/sbom-to-notices