From my time working on the Apache Web server, with the The Apache Software Foundation in other ways, OSI, and IBM (yes, since I'm not longer employed there I don't have to call them &BigCo; any more), I've learned a lot[1] about the needs of various entites at the open-software table.
Some of the players — or table-mates — include:
In addition to the combinations I haven't mentioned here, it should be obvious that there's not a lot of black and white — many entities are more than one of these at the same time.
So, what consitutes a 'best practice' in this arena? There's no one answer, clearly; each point of view has different goals and requirements. Licensing is always a
good one; a company will probably be cautious about what licences cover imported software, and open projects might licence for maximum code libre or possibly maximum commercial uptake. Then there're the communication mechanisms, decision-making processes, policies concerning direct commit access to the code repositories, etc.
So any library of 'best practices' would clearly need to have several sections to address the different points of view. Here are some concerns that should be addressed in each:
[1] Not that I in any way believe that what I've learned is complete or conclusive — are you kidding? "I am but an egg."