Private folder (submodule) in public repo

Question

I have a public repository. In it, I want to use a submodule that is private. If I include this submodule in my public repo, can everyone see the contents of this submodule?

Answer 1

No: turning on a submodule means writing its url in a .gitmodules file.

This URL will no longer be accessible through the recursive clone of your repo than it is available on its own (due to its private nature of the repo).

This is why, for example, using submodules with GitHub pages is not possible:

You can only use submodules with GitHub Pages sites that point to public repositories.
Using a submodule pointing to a private repository is not possible because the Pages server cannot access private repositories .

Answer 2

If you push your branch with a submodule to a shared repository, this means that the public will be able to see the URL of the submodule. Whether the public can see the content of the submodule depends on whether this publication is available to you. For example, if you have this in a private Github repository, the public will be able to see the URL, but will not be able to access the content.

All submodule additions actually put an entry in the url in .gitmodules , it does not insert the contents of this repository. Whether this URL is publicly available is a completely different matter.

If you want to keep even the URL of a private private repository, you will have to work in a separate local branch and never insert this branch into the shared repository. eg.

 git clone somePublicRepo cd somePublicRepo git branch neverPushThisBranch git checkout neverPushThisBranch git submodule add privateRepo git submodule update 

Since the file that describes which submodules contain the repository ( .gitmodules ) is checked in the same way as any other file in Git, if you check the submodule on a branch, no one sees this submodule unless you click on a branch in a public place.

Thus, different git branches may have a different set of submodules.

With this approach, you need to be sufficiently disciplined in how you work on branches so that you do not accidentally introduce your private branch into the world.