Automate OSS handling
Carefully judging the OSS usage in your project is a MANUAL activity! However, collecting OSS information and fulfilling license obligations should be automated as much as possible. A prominent professional tool to automate OSS compliance is the commercial software "Black Duck". Unfortunately it is rather expensive - either purchased or used as SaaS.
The most recommended lightweight tooling is a combination of Maven plugins. We will mainly use the Mojo Maven License Plugin.