47

I want to host the source code for a website I created in a public repository on Github. I want it to be public so that I can also show the source code to others, however there are some files that I want to remain private. Files that may contain passwords and such (like when connecting to databases). Is there a way to do that?

1
  • Another way is to use two repositories one private and one public. You can work in private and use something like github.com/open-condo-software/gitexporter to automatically export your files to the public repo.
    – pahaz
    Jan 8, 2022 at 19:19

3 Answers 3

30

Although keeping passwords in the repository is a bad practice as @aspyct has explained, I want to add that not all things that one might want to keep private in a repository are passwords, e.g., one might want to develop a new feature but not expose it until it's done(or maybe expose it never).

In these cases, we can create two remote repositories both associated with the same local repository, but each corresponding to a different branch. Here's a step by step instruction:

  1. Create two remote repositories(on GitHub or BitBucket or wherever else) with different names, for example: one myrepo and the other privates.myrepo. Make the myrepo a public repository and the privates.myrepo a private repository.
  2. On local, initiate a single git repository: git init.
  3. Add the non-private files now in the repository and make an initial commit.
  4. Connect this repository to the public remote:
git remote add <remote_branch_name> <remote_repository_address>

in our example which becomes:

git remote add origin https://github.com/<YOUR_USERNAME>/myrepo.git
  1. Push: git push -u origin master

  2. Now add a branch to the local repository and switch to it: git checkout -b private_work

  3. Here comes the important step: Connect this branch to the other remote, i.e, the private one. In our example:

git remote add privates https://github.com/<YOUR_USERNAME>/privates.myrepo.git
  1. Next, add the private files to the local repository and make a commit.
  2. Push the private_work branch to the privates remote: git push -u privates private_work

Read more explanation on how it works here: https://24ways.org/2013/keeping-parts-of-your-codebase-private-on-github/. I've also learned this from him.

See a cool terminal-show recording of all these steps together here: http://showterm.io/04130676d3401229e7df6

Also, you can add an alias like alias private_push='git push privates private_work in an startup script like .bashrc in case you're on Linux, in order to lower the chances of making a wrong push of private work to the public repository.

1
  • But how to publish only public work you've done in private_work? git merge private will create your private files in master.
    – facetus
    Dec 3, 2022 at 1:29
28

I see three options:

  1. either you add these files to your .gitignore, don't commit them into the repository. You may optionally provide templates for these files (something like config.php.example), for other people to customise them. That way, they can keep their config and pull the changes easily.

  2. or you put these files outside of the repository, and reference them with a relative path. define('CONFIG_DIR', '../config/');

  3. (not recommended, submodules are hard) or you put these files in a git submodule. That'll be a little longer though ;)

For reference, the Symfony framework (PHP) uses the first option and provides configuration templates.

I've used successfully option 2 in many projects, it just works, but is less user-friendly.

Never used option 3 for this kind of cases, and submodules are probably not the best tool for this. It can work though...

2
  • 2
    +1 for advicing to store sensitive files in a non-versionned folder (submodules are not a solution here imho, one should never version files containing passwords or sensitive information). I personally use option 1, having a versionned config file from which I include a non-versionned file which contains the sensitive config settings (example with a Python application, here sensitive info is the secret key used to sign cookies)
    – mdeous
    Aug 7, 2014 at 8:06
  • 1
    Thanks a lot for the information! I think I will go for option number 1 then, just ignore versioning the files containing sensitive information. Aug 7, 2014 at 8:14
2

I had the same problem, and went with option #1 from the answer by aspyct. My project is open source like yours, but also had a few parts that contain sensitive info. I did the following:

  1. Added a folder to my project (in visual studio)
  2. Added that folder to my .gitignore
  3. Created a text file in that folder that was included into git and visual studio.
  4. Cloned a private repo into a subfolder.

That way, anyone from GitHub or from looking in visual studio and see that files are missing, and the text file shows them how to get the application to build without the sensitive files.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.