I have a package that wraps a C library in a way that's easy for automated cve scanners to understand (it is added as a git submodule). If I create a zip file with swift package archive-source --output package.zip then the output doesn't include the contents of the submodule.
Link to project: Cyberbeni/swift-utf8proc: Swift wrapper for JuliaStrings/utf8proc - Codeberg.org