> You've got a non-internet CI with non-internet source code repository with non-internet vendored dependencies??

Vendored dependencies are pulled down from an internal s3 bucket (and cached locally) before the build starts, the rest of the build runs with no internet access.

Look how nix does this, it's basically the same.