Last, think about the day you no longer need this vendor at the start rather than at the end.

Insist that the repository sits on infrastructure you own from the beginning, and that documentation is updated as part of the work.