During the build process for our TypeScript-based GitHub Actions, a license.txt file is generated for each compiled package. These files aggregate the licenses of all npm dependencies used by the package.
Currently, the repository is managed under Apache-2.0 via REUSE. However, because REUSE tracks licensing on a per-file basis, it does not easily accommodate dynamically generated artifacts that include multiple third-party licenses. The result is that each dependency (and all its files) may not be properly tracked or declared in a way that maintains REUSE compliance.
Addressing this properly would likely require:
- A post-build step or script to automatically update REUSE metadata for each generated artifact.
- A review of how REUSE can or should treat compiled outputs and bundled dependency licenses.