Private Mirrors App beta (open source)

[ahpook]

Select Topic Area

Product Feedback

Body

Hi all, this isn't a Repositories product feature per se, but it's close enough that I figured this is a good spot to host the discussion.

We've been working on an open source GitHub App that manages private mirrrors of public upstream repositories. Perhaps unsurprisingly, it's called the Private Mirrors App (PMA). PMA's primary use case is for organizations who want to review their open source contributions internally before making a public PR. Due to the nature of the GitHub fork network, this isn't (currently!) possible with a built-in workflow, so the app will handle the creation, synchronization, and deletion of these private mirrors as a standalone experience.

The main benefits of working on the private mirrors through PMA are:

• Branch protection rules can enforce PR reviews by people on particular teams to ensure proper signoffs
• If commits include code/keys/docs that should not be made public, there's the opportunity to remove them and squash merge without leaking history
• Initial development can happen inside an Enterprise Managed Users (EMU) organization, whose users ordinarily can't interact with public GitHub repos. Once the app syncs a change, the public fork and upstream PR use normal github.com identities.

It's open source and available at https://github.com/github-community-projects/private-mirrors ; this week we're releasing a beta-level version (0.20) and are excited to see what kinds of contributions it can unlock.