I completely agree that you should run 1+ license checkers in your CI process, just like you should check anything else in your CI process that you care about.

I completely agree that you should run 1+ license checkers in your CI process, just like you should check anything else in your CI process that you care about. In the CII Best Practices badge project we use both the "license_finder" program (which is an OSS tool) and the FOSSA service ( https://fossa.com/ https://fossa.com/ ). Both examine the dependencies for licensing issues. While something could still slip through, it's much less likely, and more importantly we have a really good case for showing due diligence. I'm not a lawyer, but I do know that courts look very favorably on people who are demonstrably making an effort to meet their legal obligations. You're way less likely to have legal problems that way.