> Otherwise you will be left having to handle requests like "does anyone remember the exact contents of our product X, of version of 2023-03-03?" Generally, th

> Otherwise you will be left having to handle requests like "does anyone remember the exact contents of our product X, of version of 2023-03-03?" Generally, this can be solved by simply vendoring your dependencies (aka, commit them to the repository instead of fetching them for every build). > For GPL-licensed code, you should provide the sources yourself. Version 3 of the GPL simply states that "clear directions" on how to find the source code may be given. There's no requirement for you to distribute those sources yourself unless you make modifications and make the software available for sale or download. Internal use/private modifications do not need to be given away. > it is definitely worth automating I worked at a company that dealt in nothing but commercially licensed open source code. That meant we were much more likely to get requests for our source code because it was obvious we were running heavily modified open source software. That being said, despite having millions of users, we only got a few requests a month and we still didn't bother automating it. So, I'm not convinced it is worth automating unless you are in the hundreds of millions of users range.