Comment by simonw

I've solved this in the past using versioned dependencies. Repos get tagged releases, other repos can specify which version they depend on, then the deployment script has to resolve those dependencies and install the right release versions of everything else.

You can also use GitHub submodules to implement a pattern like this, but I don't really trust them for some reason.