Some of the steps look like they'd be hard to do that for. Like for example the one about making sure the license is correct, and the one about testing parts that apparently don't have good automated tests / interact with the real world.
Then those steps must be removed. I thought the mantra "deploy is ONE step" was a more or less universally acknowledged truth.
So it is clearly possible to do -- and there are all sorts of tools which figure out what SPDX license entries apply for every dependency (or vendored dependency) of a given project.
For the latter though, Fossology, Scancode etc. can help.