I want to host the source code for a website I created in a public repository on Github. I want it to be public so that I can also show the source code to others, however there are some files that I want to remain private. Files that may contain passwords and such (like when connecting to databases). Is there a way to do that?
3 Answers
Although keeping passwords in the repository is a bad practice as @aspyct has explained, I want to add that not all things that one might want to keep private in a repository are passwords, e.g., one might want to develop a new feature but not expose it until it's done(or maybe expose it never).
In these cases, we can create two remote repositories both associated with the same local repository, but each corresponding to a different branch. Here's a step by step instruction:
- Create two remote repositories(on GitHub or BitBucket or wherever else) with different names, for example: one
myrepo
and the otherprivates.myrepo
. Make themyrepo
a public repository and theprivates.myrepo
a private repository. - On local, initiate a single git repository:
git init
. - Add the non-private files now in the repository and make an initial commit.
- Connect this repository to the public remote:
git remote add <remote_branch_name> <remote_repository_address>
in our example which becomes:
git remote add origin https://github.com/<YOUR_USERNAME>/myrepo.git
Push:
git push -u origin master
Now add a branch to the local repository and switch to it:
git checkout -b private_work
Here comes the important step: Connect this branch to the other remote, i.e, the private one. In our example:
git remote add privates https://github.com/<YOUR_USERNAME>/privates.myrepo.git
- Next, add the private files to the local repository and make a commit.
- Push the
private_work
branch to theprivates
remote:git push -u privates private_work
Read more explanation on how it works here: https://24ways.org/2013/keeping-parts-of-your-codebase-private-on-github/. I've also learned this from him.
See a cool terminal-show recording of all these steps together here: http://showterm.io/04130676d3401229e7df6
Also, you can add an alias like alias private_push='git push privates private_work
in an startup script like .bashrc
in case you're on Linux, in order to lower the chances of making a wrong push of private work to the public repository.
-
But how to publish only public work you've done in
private_work
?git merge private
will create your private files inmaster
.– facetusDec 3, 2022 at 1:29
I see three options:
either you add these files to your
.gitignore
, don't commit them into the repository. You may optionally provide templates for these files (something likeconfig.php.example
), for other people to customise them. That way, they can keep their config and pull the changes easily.or you put these files outside of the repository, and reference them with a relative path.
define('CONFIG_DIR', '../config/');
(not recommended, submodules are hard) or you put these files in a git submodule. That'll be a little longer though ;)
For reference, the Symfony framework (PHP) uses the first option and provides configuration templates.
I've used successfully option 2 in many projects, it just works, but is less user-friendly.
Never used option 3 for this kind of cases, and submodules are probably not the best tool for this. It can work though...
-
2+1 for advicing to store sensitive files in a non-versionned folder (submodules are not a solution here imho, one should never version files containing passwords or sensitive information). I personally use option 1, having a versionned config file from which I include a non-versionned file which contains the sensitive config settings (example with a Python application, here sensitive info is the secret key used to sign cookies)– mdeousAug 7, 2014 at 8:06
-
1Thanks a lot for the information! I think I will go for option number 1 then, just ignore versioning the files containing sensitive information. Aug 7, 2014 at 8:14
I had the same problem, and went with option #1 from the answer by aspyct. My project is open source like yours, but also had a few parts that contain sensitive info. I did the following:
- Added a folder to my project (in visual studio)
- Added that folder to my
.gitignore
- Created a text file in that folder that was included into git and visual studio.
- Cloned a private repo into a subfolder.
That way, anyone from GitHub or from looking in visual studio and see that files are missing, and the text file shows them how to get the application to build without the sensitive files.