If you want to be serious about this, use a self-hosted CI/CD server such as TeamCity, and then mirror all dependencies on a local git server (Go supports GOPROXY variable, but you can also probably fiddle with local DNS and self-signed certs, so that any mention of github.com forwarded you to the local server). This way, it's more controllable: if github.com is down or some repo is deleted, the CI/CD server won't even notice it.