When a pull request adds a package, check five things: the license identifier, whether the package ships or is build only, what it pulls in transitively, whether the license is in your allowed list, and whether the decision is recorded. Automating the first four in CI leaves people with only the exceptions.
The five checks
1. What license does it declare, and does the file agree? Look at the license field and the LICENSE file in the package. A mismatch or a blank is a reason to stop and ask.
2. Where will it run? A test helper and a runtime library carry very different weight. Mark the scope in the pull request description.
3. What else came with it? A single added line in a manifest can add dozens of transitive packages. Look at the lockfile diff, not just the manifest diff.
4. Is the license in your policy? Allowed, review or deny. If your policy has no entry, that is a gap to fix, not a free pass.
5. Is the decision written down? Add a line to the pull request or a decision log: package, version, license, scope, approver.
What to automate
| Check | Automate? |
|---|---|
| Detect the license of new and changed packages | Yes |
| Compare against allow, review and deny lists | Yes |
| Block on deny | Yes |
| Comment on review items with the finding | Yes |
| Approve exceptions | A person, with an expiry |
For rollout advice, see turning on a license gate without breaking every build.
Reviewer questions that save time
- Could we do without it? A ten line helper may not be worth a new license to track.
- Is there already a package in the tree that does the same job?
- Is the project maintained? A license is one risk. Abandonment is another.
- Does the version in the lockfile match the version whose license you read?
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a gate reports a finding on the pull request before merge.
Safeguard lets you set policies and gates that run on pull requests, and its dependency scanning provides the package data. A free scan is at gold.safeguard.sh/scan.
Quick check
Should every new license go to legal?
No. Pre-approve common licenses by policy and send only review and unknown items.
Is checking the manifest enough?
No. Read the lockfile diff, because transitive packages bring their own licenses.
Last reviewed: 19 October 2026.
