How about the Arch Linux AUR approach?

Every package has its own git repository which for binary packages contains mostly only the manifest. Sources and assets, if in git, are usually in separate repos.

This seems to not have the issues in the examples given so far, which come from using "monorepos" or colocating. It also avoids the "nightmare" you mention since any references would be in separate repos.

The problematic examples either have their assets and manifests colocated, or use a monorepo approach (colocating manifests and the global index).