This very week I was dealing with my artifacts exploding in size because AWS got 429s from GitHub. Then Composer pulled from source and there were so many extra files and SCM folders we exceeded the max artifact size.
Another idea is to host your own package cache. That would be my preference where SCM size prohibits checking in dependencies themselves.
Another idea is to host your own package cache. That would be my preference where SCM size prohibits checking in dependencies themselves.