On (2) note that checking in vendored code is not necessary for reproducible builds, as you will get the exact revision that's in your lock file for glide or dep. You will, however, massively bloat your git repo.
"My app will build even with Github down!"
"My app will build with Github down, and the entire internet down!"
"My app will build with Github down, and the internet down, and the US government being taken over by a foreign military power!"
"My app will build with Github down, the internet down, and the US government being taken over, and Europe a smoldering crater from the last alien invasion!"
At some point - just - nobody cares that your app can build. There's bigger problems.
To me, "Github is down and not coming up!" is one of those "oh my god we now have serious problems who cares about our app" moments.