如何将私有仓库GitHub Actions工作流的输出提交至公开仓库？该操作是否可行？

Absolutely doable! I’ve set up similar workflows multiple times—here’s how to pull this off safely and reliably.

1. Prerequisites First #

Before writing the workflow, you’ll need to set up a few key things:

• A Personal Access Token (PAT): Generate one in your GitHub account settings with the public_repo permission (this lets it push to your public repo). Don’t grant unnecessary permissions—keep it minimal for security.
• Store the PAT as a Secret: Add the PAT to your private repo’s Secrets (under Settings > Secrets and variables > Actions)—name it something like PUBLIC_REPO_TOKEN so you can reference it in the workflow.

2. Workflow Implementation #

Create a new workflow file in your private repo at .github/workflows/publish-to-public.yml with these steps. I’ll break it down with explanations:

name: Publish Build Output to Public Repo
on:
  push:
    branches: [ main ]  # Trigger when code is pushed to main branch
  workflow_dispatch:    # Allow manual trigger from GitHub UI

jobs:
  publish-output:
    runs-on: ubuntu-latest
    steps:
      # Step 1: Check out your private repo's code
      - name: Checkout Private Repo
        uses: actions/checkout@v4

      # Step 2: Run your build/generate command (adjust to your project)
      - name: Generate Output Files
        run: |
          # Example for a Node.js project—replace with your own build steps
          npm install
          npm run build  # This produces a `dist` folder with your output

      # Step 3: Configure Git identity for commits
      - name: Set Up Git Credentials
        run: |
          git config --global user.name "GitHub Actions Bot"
          git config --global user.email "actions@github.com"

      # Step 4: Check out your public repo into a subdirectory
      - name: Checkout Public Repo
        uses: actions/checkout@v4
        with:
          repository: your-username/your-public-repo  # Replace with your public repo path
          ref: main  # Branch to push to in the public repo
          token: ${{ secrets.PUBLIC_REPO_TOKEN }}  # Use the PAT we stored earlier
          path: public-repo  # Directory to clone the public repo into

      # Step 5: Copy your generated output to the public repo
      - name: Sync Output Files
        run: |
          # Optional: Clear existing content in the public repo (adjust if needed)
          rm -rf public-repo/*
          # Copy the generated output (replace `dist` with your output folder)
          cp -r dist/* public-repo/

      # Step 6: Commit and push changes to the public repo
      - name: Commit and Push
        run: |
          cd public-repo
          # Check if there are actual changes to avoid empty commits
          if git diff --quiet; then
            echo "No changes to push—exiting"
            exit 0
          fi
          git add .
          git commit -m "Update output from private repo (commit: ${{ github.sha }})"
          git push origin main

3. Key Best Practices & Notes #

• Security First: Never hardcode your PAT or any sensitive data in the workflow file. Always use GitHub Secrets.
• Avoid Empty Commits: The workflow above checks for changes before committing—this prevents unnecessary empty commits to your public repo.
• Handle Conflicts: If others push to the public repo, you might hit merge conflicts. To mitigate this, add a step to pull the latest changes before pushing:

  cd public-repo
  git pull origin main --rebase
  

• Output Size: Make sure your generated output doesn’t exceed GitHub’s repo size limits (1GB total, 100MB per file). For large files, use Git LFS.
• Trigger Flexibility: Adjust the on section to fit your needs—use schedule for daily updates, or keep workflow_dispatch for manual runs.

4. Is This Feasible? #

100% feasible! GitHub Actions is designed for exactly this kind of cross-repo automation. As long as you configure permissions correctly and follow security best practices, this workflow will run reliably every time.

内容的提问来源于stack exchange，提问作者Spooky