# Private Fork Sync

> Make a public GitHub fork private and keep it synced with its upstream parent. Use when the user wants to make a fork private, or to pull/sync newer commits from the upstream parent into their fork.

- **Type:** Skill
- **Install:** `agentstack add skill-soulmachine-skills-private-fork-sync`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [soulmachine](https://agentstack.voostack.com/s/soulmachine)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [soulmachine](https://github.com/soulmachine)
- **Source:** https://github.com/soulmachine/skills/tree/main/private-fork-sync

## Install

```sh
agentstack add skill-soulmachine-skills-private-fork-sync
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

Convert a fork's visibility to private, then keep it current by fetching from the parent. The whole workflow stays effortless on one condition: the fork's default branch is a **clean mirror** of upstream, so every sync is a **fast-forward** — no merge commits, no conflicts.

Prerequisite: `gh` authenticated with `repo` scope, plus a local clone of the fork. Examples use `master`; if the repo's default branch is `main`, substitute it (`gh repo view / --json defaultBranchRef -q .defaultBranchRef.name`).

## Make a fork private

GitHub now converts a fork's visibility in place — historically this was blocked, which is why mirror-clone workarounds still circulate; you don't need them.

```
gh repo edit / --visibility private --accept-visibility-change-consequences
```

`--accept-visibility-change-consequences` is required, and the command prints nothing on success.

Completion: `gh repo view / --json visibility,isPrivate` reports `PRIVATE` / `true`.

Tell the user two consequences:
- While private, you can't open PRs from the fork to the public parent. Reverse with `--visibility public --accept-visibility-change-consequences` when you want to contribute upstream.
- Anyone who could see the public fork now needs to be added as a collaborator.

If the direct change is ever rejected (e.g. org policy), fall back to the documented mirror method: create a new private repo, then `git clone --bare` the fork and `git push --mirror` into it.

## Set up syncing (one-time)

Add the parent as a fetch-only `upstream` remote, with push disabled so you can never accidentally push to a repo you don't own:

```
git remote add upstream https://github.com//.git
git remote set-url --push upstream DISABLE
git fetch upstream
```

Completion: `git remote -v` shows `upstream` fetch plus push URL `DISABLE`.

## Sync when upstream has new commits

```
git fetch upstream
git checkout master
git merge upstream/master
git push origin master
```

One-liner alternative (relies on the same **clean mirror** condition): `gh repo sync / -b master` then `git pull origin master`.

Completion: `git rev-list --left-right --count master...upstream/master` prints `0	0` (local neither ahead nor behind).

## Keep the mirror clean

The **fast-forward** guarantee holds only while `master` carries no commits of your own. Custom work goes on a separate branch, never on the mirror branch:

```
git switch -c my-changes        # do your work here, not on master
git switch my-changes && git rebase master   # pick up upstream after each sync
```

If `master` has already diverged, `git rev-list` above shows a nonzero left count and the merge stops fast-forwarding — move those commits onto a branch and hard-reset `master` to `upstream/master` to restore the mirror.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [soulmachine](https://github.com/soulmachine)
- **Source:** [soulmachine/skills](https://github.com/soulmachine/skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-soulmachine-skills-private-fork-sync
- Seller: https://agentstack.voostack.com/s/soulmachine
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.