I use a private submodule (hosted on my own infra) for the inputs, which addresses point 1. But I get where you're coming from.