This is not nearly as clever a response as it sounds. It's moving the goalposts. I don't produce anything where Linux's relationship to the application is as

This is not nearly as clever a response as it sounds. It's moving the goalposts. I don't produce anything where Linux's relationship to the application is as something that lives inside the build (unlike the types of third-party NPM dependencies we're talking about here) and I have a suspicion that there isn't any Linux inside the artifacts that your build step produces, either. If that's not the case for you, then yeah, I'll bite the bullet. You absolutely can either: (a) include that source code in your repo or (b) stop building things like that. If you find that going with the former option isn't easy, then that's because it never was—whether you're checking in all the source code or not.