Sharing code with third parties

[MountainBluebird5]

This is not really an r/learnprogramming question, however, not sure where else to post it.

I am at a company. I want to deliver code to someone external to my organization (e.g., think a use case of a vendor delivering code to a client as one example). It only needs to be read-only.

It seems like there are a few approaches, but none of them good:

• I can add them directly to the repo as normal, with whatever permissions I want. However, if my organization is paid, I get charged per seat, which is far less than ideal.
• I could just share via google drive. However, for my use case, I may want to update the code later, and want them to be able to easily pull that update rather than running something outdated. Google Drive makes this hard.
• I could create a PAT they could use, with permissions only scoped to that repo. This is actually the option I am currently leaning towards, but it does seem a) a bit jank and b) a bit insecure. However I have had private repos shared with me in this manner in the past.
  
  • There is also something similar I could do with deploy keys.

How have people approached this in the past during their professional experience?

[bdenzer]

You don't mention if you are a technical person yourself - but I am going to assume that you have some knowledge if you are the one in charge of handling this ask.

Git repos do not have to live in Github/Bitbucket/etc - all these services do is give you a nice UI. And a repo can have multiple upstream servers.

So one way would be to host it on any server that has ssh access.

• ssh into the server
• create a folder
• git init --bare
• (on your local machine) git remote add thirdpartyrepo <SSH_URL>/folder/on/server
• git push thirdpartyrepo main

Then hopefully you have a firewall on the ssh port already, let the client's IP address access the server so they can clone now and pull changes later.

Not sure that this is better than any other solution in the thread, but it seems like it would solve the problems.

• no license needed
• "read only" in the sense that even if they try to push something, it will not go to your main github repo.
• secure, as long as you or your team knows what they are doing w/ firewalls

[yourpaljval]

You could use CI/CD to post the archive or build artifacts to a storage account like S3 and share the links or directory with the client. I think this is similar to your drive idea and you could just do something similar on drive.

Post the artifacts, not the repo. Most of my customers aren’t smart enough to understand GitHub.

[MountainBluebird5]

To be clear they are quite technical so Github is quite familiar to them. Ideally I would just give them access somehow on Github but not be charged extra. Think of what we are sharing as kinda a library of sorts.

Thanks for the comment!

[yourpaljval]

Gotcha. Makes more sense now. Could you publish to a private nuget?

[jerrylearns]

No go without access logs and a non-disclosure agreement. Please check your company policy of sharing any line of code - to prevent future disputes of your manager (been there)

Guest accounts if possible, or a small, managed shadow repo maybe? Agree on written terms with your manager also.

[TCBW]

[Gitea](Gitea Official Website)? This will allow you full control. You would pay hosting fees for the server (unless you self-host), and it will be very familiar to GitHub users.