Visibility

Control what code is public and what stays private, with path-based rules and automatic mirroring to open-source repositories.

The Problem

Modern projects often have a mix of public and private content. You want to open-source your library code, documentation, and tests, but keep your internal planning documents, proprietary algorithms, and AI configurations private. Traditional approaches force you to choose:

Separate repositories — painful to keep in sync, code duplication, broken imports
Everything public — leaks internal strategy, plans, and proprietary code
Everything private — no community contributions, no portfolio visibility

The Solution

EZKeel introduces path-based visibility rules. In your workspace.yaml, you declare exactly which paths are public and which are private:

workspace.yaml
            
            
            
          

visibility:
  default: private          # everything is private unless listed
  public_paths:
    - src/               # open-source code
    - docs/              # documentation
    - tests/             # test suite
    - README.md          # project readme
    - LICENSE            # license file
    - CONTRIBUTING.md    # contribution guide
  private_paths:
    - plans/             # internal planning docs
    - internal/          # proprietary code
    - .claude/           # AI persona config
    - workspace.yaml     # this config file
        

The default: private setting means any file not matched by public_paths stays private. Explicit private_paths act as a safety net — even if the default changes, these paths are always excluded.

Publishing

The ezkeel publish command reads these rules, copies only the public paths to a temporary directory, and force-pushes the result to your public repository:

terminal

# Preview what would be published $ ezkeel publish --dry-run Dry run -- files that would be published: src/main.go src/handlers/auth.go docs/README.md tests/auth_test.go LICENSE # Show configured visibility rules $ ezkeel publish --diff Public paths configured in workspace.yaml: + src/ + docs/ + tests/ + README.md + LICENSE Private paths: - plans/ - internal/ - .claude/ - workspace.yaml # Publish to the public repo $ ezkeel publish --forgejo-url https://git.example.com/org/my-project-public Published public paths to https://git.example.com/org/my-project-public

Automatic Mirroring

You can automate the publish step with a Forgejo Action that runs on every push to main:

.forgejo/workflows/publish.yaml
            
            
            
          

name: Publish Public Mirror

on:
  push:
    branches: [main]

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install EZKeel
        run: go install github.com/ezkeel/ezkeel/cmd/ezkeel@latest
      - name: Publish public paths
        run: ezkeel publish --forgejo-url $PUBLIC_REPO_URL
        

This ensures your public mirror is always up to date without manual intervention.

How It Works

The publish process follows five steps:

Read Rules

EZKeel reads visibility.public_paths and visibility.private_paths from workspace.yaml.

Walk the Repository

It walks every file in the current directory (skipping .git), checking each path against the visibility rules.

Copy Public Files

Files matching public_paths (and not matching private_paths) are copied to a temporary directory, preserving directory structure.

Create a Git Commit

The temporary directory is initialized as a Git repo, and all files are committed with a "publish: update public mirror" message.

Force Push

The commit is force-pushed to the main branch of the public repository, completely replacing its contents with the filtered snapshot.

Important: The public repository is a mirror, not a fork. It is completely overwritten on each publish. Do not make direct commits to the public repo — they will be lost on the next publish.