GitLab Compliance - Hands-On Lab: Enable and Configure License Compliance

This Hands-On Guide walks you through enabling and using License Compliance in a GitLab project.

Estimated time to complete: 15 minutes

Objectives

When you add new dependencies to a project, you need to carefully consider how the licenses of the dependencies impact the project. To ensure that license requirements are met, you can add a policy to require approval for newly detected licenses.

In addition to scanning dependencies for vulnerabilities, the dependency scanner will also record the license that each dependency uses.

The License Compliance report will generate a list of all of the licenses detected in the project that are out of compliance with the project policies.

Task A. Setting up Your Project

Before we start using license compliance scans, it is helpful to have some licenses setup in our project.

  1. Navigate to your project.

  2. Select + > New file.

  3. In the Filename, type requirements.txt

  4. In the contents, add the following text:

    #
# This file is autogenerated by pip-compile with Python 3.12 by the following command:
#
#    pip-compile --output-file=requirements.txt requirements.in
#
fastapi==0.135.1

  5. Select Commit changes.

  6. Add any commit message. Switch the Branch setting to Commit to a new branch.

  7. In the Target Branch field, enter the name add-deps.

  8. Ensure that Create a merge request for this change is checked.

  9. Select Commit changes.

  10. Leave all options in the Merge Request as default and select Create Merge Request.

  11. Select Merge.

    NOTE The “Merge” button may instead say “Set to auto-merge” if your pipeline is still running. This is fine - click the button, and the MR will merge as soon as the pipeline successfully completes.

  12. In the left sidebar, select Code > Repository.

  13. Select + > New file.

  14. Name the file .gitlab-ci.yml.

  15. Add the following contents to the file:

    stages:
    - test
include:
  - component: ilt.gitlabtraining.cloud/components/dependency-scanning/main@main

  16. Select Commit changes

  17. Set the Commit message to “Added pipeline configuration file with Dependency Scanning” or something similar.

  18. Select the Commit to a new branch option, and set the Target Branch to add-scans.

  19. Ensure that Create a merge request for this change is checked.

  20. Select Commit changes.

  21. Leave all options as default and select Create Merge Request.

  22. Select Merge.

These changes have added dependency scanning and dependencies to your application. With these changes, you will now be able to view your project licenses and control license compliance.

Task B. License Compliance Scans

  1. Navigate to Build > Pipelines. Open your newly created pipeline by clicking on its status. You should see the dependency-scanning job running.

  2. Once your pipeline has successfully completed, navigate to Secure > Dependency list.

  3. Click any of the licenses to view more details about the license and the compliance requirements.

Task C. Approve and Deny Licenses

Let’s assume that your team has approved the MIT license. If any license aside from the MIT license exists in a dependency, it must be approved before the Merge Request can be complete.

  1. Navigate to Secure > Policies.

  2. Click the New policy button.

  3. Click Merge Request approval policy > Select policy.

  4. Input any name (ex. ScanApprovedPolicy) and description for the policy.

  5. Set the Policy status to Enabled.

  6. Set the Policy enforcement to Strictly enforced.

  7. In Rules, set the Select scan type dropdown menu to License Scan. Ensure that all protected branches with No exceptions is selected for the Merge Request target.

  8. Set the Status is dropdown menu to Newly Detected.

    Next, we want to add the MIT License to our Allow list. There are a couple of ways to do this. Firstly, you could use allowlists and denylists through clicking on the link which says allowlist (0 licenses). However, we are going to use a slightly different method which will help us more closely control which licenses are allowed and denied.

  9. On the right-hand side of the License is section, click on the delete button (which looks like a bin icon).

  10. Select Add new criteria and choose License type from the dropdown.

  11. In the dropdown that currently says Matching, change this to Except.

    Doing this will mean that every license requires MR approval except the one we are about to choose, meaning that this specific license is allowed.

  12. In the Select license types dropdown, search for MIT License and select it. There are a couple of licenses that share a similar name, so make sure you select the correct one.

  13. In the Actions section, require 1 approval from an individual user. Click your username as the approval user.

  14. Expand out the Advanced settings.

  15. Deselect the Prevent approval by merge request’s author and Prevent approval by commit author settings.

  16. Click Configure with a Merge Request.

  17. In the resulting Merge Request, click the Merge button.

  18. When you create a policy, GitLab will create a new project for managing the policies. After you click Merge, you will need to navigate back to your original project.

Task D. View the License Compliance report for a pipeline

  1. In the left sidebar, select Build > Pipelines.

  2. Select the New pipeline button at the top right of the page.

  3. Leave all of the options at their default values, then select New pipeline.

  4. Monitor your pipeline and wait for each job to complete successfully.

  5. Once all of the jobs are complete, refresh the page. Select the Licenses tab.

  6. Notice that GitLab now describes every license except the MIT License as a policy violation. This report helps to flag existing dependencies which may contain licenses that you have not approved.

Task E. Create an MR that adds a dependency with a denied license

  1. Create a new branch named add-dnspython-dependency.

  2. Add a new dependency to the add-dnspython-dependency branch (not the main branch!) by pasting dnspython==2.1.0 as a new line at the end of requirements.txt.

  3. Click the Create Merge Request button.

  4. Leave all fields as their default values and click Create Merge Request.

  5. Wait for the pipeline for the Merge Request to complete.

  6. Once the pipeline completes, refresh the page. A license compliance scan will now display, showing 1 new license detected.

  7. Return to the Merge Request overview.

  8. Click Full report.

  9. The license compliance report will list all of the licenses that are no longer in compliance with the project policy. Note that the merge status will appear stating Requires 1 approval from policy.

  10. A new comment is also added to the activity of the Merge Request, stating that a policy violation was detected.

    This Merge Request now requires additional approval because dnspython does not use an approved license. A reviewer can now verify if the license is ok to proceed with before the merge is complete.

Task F. Lab Policy Cleanup

To ensure that you can merge branches into main without approval, it is best to disable the policy.

  1. Navigate to Secure > Policies.

  2. Click on the policy you created. Click Edit policy.

  3. Click Delete Policy at the bottom of the page.

  4. Click Merge on the resulting Merge Request.

Lab Guide Complete

You have completed this lab exercise. You can view the other lab guides for this course.

Suggestions?

If you wish to make a change to the lab, please submit your changes via Merge Request.

Last modified April 14, 2026: Updated and fixed Compliance ILT Labs (c2465970)
View page source - Edit this page - please contribute. Creative Commons License