If your public repo is a bare repo (meaning you can rebase anything directly on the public repo itself), and if you set the git config receive.denyNonFastForwards
and receive.denyDeletes
to true, then you should be ok.
If set to true, git-receive-pack
will deny a ref update which is not a fast-forward. Use this to prevent such an update via a push, even if that push is forced.
If set to true, git-receive-pack
will deny a ref update that deletes the ref. Use this to prevent such a ref deletion via a push.
See also "Is there a way to configure git repository to reject 'git push --force
'?".
Note that those settings aren't available directly for a GitHub repo, for instance.