Vendoring is the approach taken by many. Personally, I use godep. It vendors into your source the different libraries that you are using at a specific version (git hash in all the cases I use). This handles the compiling and locks in the particular version of the library which you have presumably audited. As far as testing goes, as long as you are making use of interfaces, testing should be easy enough.