Private folder (submodule) in a public repo

Question

I have a public repository. In it I want to use a submodule that is private. If i include this submodule into my public repo, will everyone be able to see the contents of that submodule?

Encroach

Answer 1

No: Including a submodule in a public repository means recording its URL in a public .gitmodules file.

The repository at that URL will not be any more accessible through a recursive clone of your repository than it is on its own.

That is why, for instance, using submodules with GitHub Pages is not possible:

You can only use submodules with GitHub Pages sites that point to public repositories.
Using a submodule that points to a private repository is not possible because the Pages server cannot access private repositories.

Lobectomy

Aw shoot, thanks Vonc. I voted you up but accepted the 1.7k'er below as he needs points :) – Encroach

@Encroach And his answer is incorrect. You can publish .gitmodules in your public branch/repo. – Lobectomy

Thanks, switched to you. I appreciate it a lot! :) – Encroach

The point is: seeing a .gitmodules with a private repo url does not mean being able to access said private repo. – Lobectomy

Answer 2

If you push your branch with the submodule to the public repository, it means that the public will be able to see the URL to the submodule. Whether the public can see the contents of the submodule depends on whether you have it accessible to the public. For example, if you have it in a private Github repository, the public will be able to see the URL but won't be able to access the contents.

All adding a submodule actually does is put an entry to the url in .gitmodules, it doesn't paste in the contents of that repository. Whether that URL is publicly accessible is another matter entirely.

If you want to keep even the URL to the private repository private, you have to work on a separate local branch and never push that branch to the public repository. eg.

git clone somePublicRepo
cd somePublicRepo
git branch neverPushThisBranch
git checkout neverPushThisBranch
git submodule add privateRepo
git submodule update

Since the file that describes what submodules a repository contains (.gitmodules) is checked in just like any other file in Git, if you check out a submodule on a branch, nobody sees that submodule unless you push the branch to a public place.

This is how different git branches can have a different set of submodules.

With this approach you need to be fairly disciplined in how you work on branches, lest you accidentally push your private branch to the world.

Gemoets

Answer 3

I just prove adding private repo is possible, and @Vonc comment is correct.

The point is seeing a .gitmodules with a private repo url does not mean being able to access said private repo.

I also found that we need to git rm -r --cached if it is already in the index.

Cramoisy