Vendorizing using git submodule should be a robust mitigation for this problem.

This feels like the modern analog of the king, the mice, and the cheese. What cats do I need to bring in to eat my git submodules?

subtree is better for this case, you want to encourage actual reading before running. reading won't catch everything but it catches a lot, and the burden isn't as high as people always complain about before they try it.