How to safely share only a specific branch (older version) with external developers?

[onggizam]

Body

Hi everyone 👋

I’d like to get some advice on how to safely collaborate with external developers while using GitHub (Free plan).

How to safely share only a specific branch (older version) with external developers?

Situation

• Our team is using a private GitHub Organization (Free plan).
• We need to collaborate with external developers (freelancers/partners), but we only want to give them access to an older version of the code for review, not the latest code.
• In other words, external developers should only have access to a specific repository and a specific branch, not everything.

Options considered so far

1. Outside Collaborator

   • Simple to set up, but once invited, collaborators can see all branches in the repository.
   • This doesn’t meet the requirement of restricting them to a single branch.

2. Create a new repository via Fork/Export

   • Take a specific branch (tag/commit) from the main repository, create a new repository, and invite external collaborators there.
   • This way, they only see what we want them to see.
   • Downside: adds operational overhead since we need to sync updates from the main repo (possibly using CI/CD automation).

3. Create a new Organization

   • Set up a separate GitHub Organization dedicated to external collaboration.
   • Only mirror/clone the specific branch or snapshot needed for external review.
   • Provides strong separation and security between internal and external environments.
   • Downside: higher management overhead, since we need to maintain two organizations in parallel.

Question

Is there a better approach that I might be missing?
If you have suggestions or best practices for securely sharing only a specific branch (older version) with external developers on GitHub (Free plan), I’d really appreciate your advice.

Thanks in advance 🙏

Guidelines

• I have read and understood this category's guidelines before making this post.

[queenofcorgis]

Hey there! 👋

Thanks for posting in the GitHub Community, @seunggihong ! We're happy you're here. You are more likely to get a useful response if you are posting in the applicable category. The Accessibility category is a place for our community to discuss and provide feedback on the digital accessibility of GitHub products. Digital accessibility means that GitHub tools, and technologies, are designed and developed so that people with disabilities can use them.

I've gone ahead and moved this to the correct category for you, Repositories. Good luck!

[onggizam]

Thank you!🙏

[ALOITH-exe]

The safest option is to extract the branch into a new repository so external developers can’t access other branches.

`# Clone your original repo
git clone
cd

Create a new bare repo for sharing

git clone --bare temp-repo.git
cd temp-repo.git

Push only the specific branch to a new remote repo

git push --mirror refs/heads/branch-name:refs/heads/branch-name
`

[onggizam]

Thank you for answer

Isn’t there another way?

[victormoni]

Hi @seunggihong 👋

Great question — this is a common challenge with GitHub Free plan since branch-level permissions are only available in paid plans.

Here are a few practical options:

1. Create a separate repository

• Export or clone the specific branch (or commit snapshot).
• Push it to a new private repo.
• Invite external collaborators only to that repo.
  ✅ Easiest and safest way to limit access.

2. Use a mirror/fork approach

• Mirror just the branch you want reviewed into another repo (can be automated with CI/CD).
• External developers only see that repo, not the full codebase.

3. Patch-based workflow (advanced)

• Instead of giving repo access, you can share a patch file (git format-patch) or zip archive of the branch.
• They can review locally and send you changes back as patches.
• Useful if you don’t want to manage another repo.

⚠️ With the Free plan, there’s no way to restrict collaborators to a single branch inside the same repo.
The safest approach is to use a separate repository and give access only there.

Hope this helps! 🚀

[onggizam]

Thank you for answer 😎