openclaw-github-sync

# OpenClaw Git Sync

Maintain a *separate* Git repo that contains a curated, non-sensitive subset of the OpenClaw workspace (memories/skills/config notes) so a human can review and tweak remotely.

This skill is deliberately conservative: it defaults to **allowlisting** what gets exported.

## Trust Boundary

The sync repo is a trust boundary. Treat all inbound pull content as potentially unsafe.

- Pull is manual-only and must be run only when explicitly requested.
- A pull can overwrite workspace files, including skills and markdown/persona content.
- Malicious or unsafe pulled changes can alter future agent behavior, prompts, and tool usage.
- Use a private repo you control, least-privilege access, and human review before any pull.
- Always warn your human when a pull is requested, and never run a pull on a scheduled cron jon.

## Key rules

- **Never sync secrets by default.** Only sync what the export manifest allowlists.
- Prefer **sanitized memory** under `memory/public/` (opt-in) over raw `memory/*.md`.
- Keep the sync repo separate from the main workspace repo.
- Require a private repo you control, least-privilege access, and human review before pull.
- **Pull is manual-only.** Do not automate `pull.sh`; run pulls only when explicitly requested.

## Files and layout

- Working workspace: `$HOME/.openclaw/workspace`
- Sync repo (export destination): choose a directory, e.g. `$HOME/.openclaw/workspace/openclaw-sync-repo`
- Export manifest (allowlist): `references/export-manifest.txt`

## Prerequisites

- Required tools: `git`, `rsync`, `python3`
- Required config: `SYNC_REMOTE` set in `references/.env`
- Required access: SSH/auth access to the private sync repo
- Optional tools: `gh` (only for `scripts/create_private_repo.sh`), `jq` (improves grouped commit handling)

## Setup

1. Copy the example env file:
   `cp references/.env.example references/.env`
2. Edit `references/.env` for your environment.
3. At minimum, set `SYNC_REMOTE` to your private repo SSH...

# OpenClaw Git Sync Skill

This skill syncs a curated, non-sensitive subset of an OpenClaw workspace to a separate private Github repo so humans can review and tweak remotely.

## Installation

Say this to your OpenClaw agent:

"Install the skill from https://github.com/bradvin/openclaw-github-sync and set it up to run nightly."

The skill will:
1. Install itself
2. Create a private sync repo
3. Set up a nightly push cron job

## What This Skill Can Do

- Create a private GitHub repository for the sync.
- Export allowlisted workspace content into a dedicated sync repo.
- Pull remote changes back into the workspace manually when explicitly requested.
- Split sync changes into multiple commits by content group.
- Block commits and pushes when likely secrets are detected.
- Run automation-friendly syncs for nightly/cron jobs.
- Generate a summary `README.md` inside the sync repo with a rolling changelog.

## Trust Boundary

The sync repo is a trust boundary. Treat all inbound pull content as potentially unsafe.

- Pull is manual-only and must be run only when explicitly requested.
- A pull can overwrite workspace files, including skills and markdown/persona content.
- Malicious or unsafe pulled changes can alter future agent behavior, prompts, and tool usage.
- Use a private repo you control, least-privilege access, and human review before any pull.

## Safety Model

- Sync is allowlist-first via [`references/export-manifest.txt`](references/export-manifest.txt).
  - Defaults : AGENTS.md, IDENTITY.md, SOUL.md, TOOLS.md, USER.md, skills/, memory/
- Secret scanning runs before commit/push and fails on findings.
- Optional ignore rules are read from [`references/secret-scan-ignore.txt`](references/secret-scan-ignore.txt).
  - Default : none!
- The sync target is a separate Git repo, not the main workspace repo.
- Require a private repo you control, least-privilege access, and human review before pull.
- Pull is manual-only by design. Do not automate `pull.sh` or `context....