I’m doing that with Composer, with the method described in this thread. It’s a bit verbose but it works.
Here’s an example: https://gist.github.com/fvsch/a34c7a87d2813f23abaffbd2cbcfda59
One thing I found out was that using the “package” repository type meant that if the repo you’re referencing has a composer.json, it will be ignored. This type mostly means "clone the repo and put it in vendor".