如何实现GitHub private repo与public repo同步？含贡献更新需求

Absolutely! Let’s tackle your questions directly, since your setup (private deploy repo + public contribution repo) is a common workflow for maintaining secure deployments while welcoming community input.

Short answer: Yes, absolutely. You can set up both one-way and two-way sync using Git remotes and either manual commands or automated workflows. The key is managing the sync carefully to avoid overwriting sensitive data in your private repo.

Your specific goal—pulling community changes from the public repo into your private repo (without losing sensitive data like environment variables)—is totally achievable. Here’s a step-by-step guide:

Manual Sync (For One-Off or Regular Checks) #

First, set up your local environment to work with both repos:

1. Clone your private repo locally (if you haven’t already):

   git clone git@github.com:your-username/your-private-repo.git
   cd your-private-repo
   

2. Add your public repo as a "remote" (this lets Git pull changes from it):

   git remote add public git@github.com:your-username/your-public-repo.git
   

3. Pull the latest changes from the public repo:

   git fetch public
   

4. Merge public changes into your private repo’s main branch:

   git merge public/main
   

   • If there are conflicts (e.g., config files where your private repo has sensitive data and the public repo has a cleaned version), Git will flag them. Resolve these by keeping your private repo’s version of sensitive files, while accepting the community’s changes to non-sensitive code.
5. Push the merged changes back to your private repo:

   git push origin main
   

   Heroku will automatically pick up the changes and deploy your updated site.

Automated Sync (For Hands-Off Updates) #

If you want to avoid manual steps every time someone contributes to the public repo, use a GitHub Action to auto-sync changes:

1. Go to your private repo’s Settings > Secrets and variables > Actions and create a new secret named PRIVATE_REPO_TOKEN—use a Personal Access Token (PAT) with full repo permissions.
2. Create a new workflow file in your private repo at .github/workflows/sync-public-to-private.yml with this code:

   name: Sync Public Contributions to Private Deploy Repo
   on:
     # Trigger when the public repo's main branch gets pushed to
     repository_dispatch:
       types: [public-repo-update]
     # Or trigger on a schedule (e.g., daily at 9 AM UTC)
     schedule:
       - cron: '0 9 * * *'
   
   jobs:
     sync:
       runs-on: ubuntu-latest
       steps:
         - name: Check out private repo
           uses: actions/checkout@v4
           with:
             token: ${{ secrets.PRIVATE_REPO_TOKEN }}
             fetch-depth: 0 # Needed to pull all history for merging
   
         - name: Add public repo as remote
           run: git remote add public https://github.com/your-username/your-public-repo.git
   
         - name: Fetch latest changes from public repo
           run: git fetch public
   
         - name: Merge public changes into private main
           run: git merge public/main --no-edit # Use --no-edit to auto-merge if no conflicts
           continue-on-error: true # If conflicts occur, the workflow will fail so you can resolve manually
   
         - name: Push merged changes to private repo
           run: git push origin main
   

3. (Optional) To trigger the workflow automatically when the public repo is updated, add a small workflow to your public repo that sends a dispatch event to the private one.

Critical Notes to Protect Your Sensitive Data #

• Never commit sensitive data to the public repo: Ensure your public repo’s .gitignore excludes files like .env, config/production.js, or any other files with secrets.
• Use merge strategies wisely: If you have files you never want overwritten (e.g., your private env config), use git merge -X ours public/main to force Git to keep your private version of conflicting files. Just be careful—this will ignore all changes to those files from the public repo.
• Always review merged changes: Even with automation, it’s a good idea to periodically check the private repo’s commit history to ensure no unintended changes slipped through.

内容的提问来源于stack exchange，提问作者Sarthak Maheshwari