How to handle dependencies that use NPM to get their dependencies?

[CodeSandwich]

I'm working on a smart contract that uses contracts from https://github.com/LayerZero-Labs/LayerZero-v2, so I added it as a sumbodule dependency. It works fine when using Solidity files from LayerZero-v2 that don't have any external dependencies, but it fails when using files depending on OpenZeppelin:

[⠊] Compiling...
[⠒] Unable to resolve imports:
      "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol" in "/home/zuczek/workspace/drips-contracts/lib/LayerZero-v2/protocol/contracts/libs/Transfer.sol"
      "@openzeppelin/contracts/token/ERC20/IERC20.sol" in "/home/zuczek/workspace/drips-contracts/lib/LayerZero-v2/protocol/contracts/libs/Transfer.sol"
with remappings:
      ds-test/=/home/zuczek/workspace/drips-contracts/lib/forge-std/lib/ds-test/src/
      forge-std/=/home/zuczek/workspace/drips-contracts/lib/forge-std/src/
      openzeppelin-contracts/=/home/zuczek/workspace/drips-contracts/lib/openzeppelin-contracts/contracts/
      chainlink/=/home/zuczek/workspace/drips-contracts/lib/chainlink/contracts/src/v0.8/
      layer-zero/=/home/zuczek/workspace/drips-contracts/lib/LayerZero-v2/protocol/contracts/interfaces/
      layer-zero-fail/=/home/zuczek/workspace/drips-contracts/lib/LayerZero-v2/protocol/contracts/
      LayerZero-v2/=/home/zuczek/workspace/drips-contracts/lib/LayerZero-v2/
      erc4626-tests/=/home/zuczek/workspace/drips-contracts/lib/openzeppelin-contracts/lib/erc4626-tests/
      openzeppelin/=/home/zuczek/workspace/drips-contracts/lib/openzeppelin-contracts/contracts/
[⠆] Compiling 105 files with 0.8.24
[⠰] Solc 0.8.24 finished in 96.73ms
Error: 
Compiler run failed:
Error (6275): Source "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol" not found: File not found. Searched the following locations: "/home/zuczek/workspace/drips-contracts".
 --> lib/LayerZero-v2/protocol/contracts/libs/Transfer.sol:5:1:
  |
5 | import { SafeERC20 } from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Error (6275): Source "@openzeppelin/contracts/token/ERC20/IERC20.sol" not found: File not found. Searched the following locations: "/home/zuczek/workspace/drips-contracts".
 --> lib/LayerZero-v2/protocol/contracts/libs/Transfer.sol:6:1:
  |
6 | import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol";
  | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This is caused by the fact that LayerZeroV2 has its dependencies managed with NPM, in its package.json it has:

{
  ...
  "dependencies": {
    "@openzeppelin/contracts": "^4.8.1",
    ...
  },
  ...
}

What's the best way to handle a dependency like LayerZeroV2?

Doing cd lib/LayerZero-v2 && npm install is pretty bad, it needs to be manually done and it sneakily introduces the requirement to have NPM installed on the machine, which is problematic on the CI.

As of now I have it worked around by adding a remapping to my project that directs @openzeppelin/=lib/openzeppelin-contracts/ to the instance used in my project and installed as a submodule, luckily they are compatible enough to compile. It's an awful hack, a clearly wrong solution that surely will harm me very soon.

[CodeSandwich]

I think that the answer may be to use Soldeer.