Clarify license compliance snapshot requirements (#64481)

Co-authored-by: Leyla Azizova <289007686+leyla-zova@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: leyla-zova

content/code-security/concepts/supply-chain-security/open-source-license-compliance.md

@@ -36,6 +36,14 @@ If there is a ruleset in **Active** mode which uses the "Requires license compli
 
 Additionally, a [branch protection rule](/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule) that requires comment resolution before merging will track annotations from license checks, so even alerts generated by **Evaluate** rulesets will be subject to the protection.
 
+### Dependency snapshots
+
+Dependency snapshots describe a repository's dependencies at a specific commit. License compliance compares snapshots for the base and head commits of a pull request to identify added dependencies and evaluate their licenses against your policy.
+
+For each detector that submitted a snapshot for the base commit, the check waits for a snapshot from that detector for the exact head commit. The check resumes when all required snapshots arrive. For example, if a workflow or external system submits snapshots only for commits to the default branch, the head commit does not receive that detector's snapshot and the check remains waiting.
+
+Automatic dependency submission runs on both the base and head commits. When it submits the snapshots your repository needs, you do not need to add another detector. For more information about automatic dependency submission, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/submit-dependencies-automatically).
+
 ## Where results appear
 
 If a dependency's license isn't in your policy, findings will appear in pull request annotations. The annotations do not automatically generate an exception request, because the developer could decide to modify their code to avoid the noncompliant dependency. If they do want to use the dependency, {% data variables.product.github %} will prompt the developer for more information, then send the closure request to the Enterprise Open Source License Managers, who have permission to modify the policy.

content/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-license-policies.md

@@ -106,6 +106,14 @@ For more information about rulesets, see [AUTOTITLE](/repositories/configuring-b
 
 If the ruleset is in **Active** mode, the pull request remains blocked until all license policy violations are resolved.
 
+## Troubleshooting checks waiting for dependency snapshots
+
+If a license compliance check reports `Waiting for dependency snapshots on head`, the pull request's head commit is missing one or more snapshots that were submitted for the base commit. This can happen when a workflow submits snapshots for the base branch but does not submit them for the pull request's head commit.
+
+The message can list detectors that submitted a snapshot for the base commit but not yet for the head commit. Review those detectors and the workflows or external systems that submit their snapshots. If you submit snapshots through your own workflow or the {% data variables.dependency-submission-api.name %}, configure it to also submit snapshots for the pull request's head commit. If automatic dependency submission is enabled and already submits the snapshots your repository needs, you do not need to add another detector. Adding another detector can increase the number of snapshots the check expects on the head commit.
+
+For more information about snapshot submission, see [AUTOTITLE](/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/use-dependency-submission-api).
+
 ## Managing license compliance requests and policy
 
 ### Review and handle exception requests