This situation is common at large software companies which contribute to open source projects, so there are some tools you can find specifically to migrate between open and closed repositories. I have used these tools. They generally work like this:
You have your internal repository. This could be a monorepo containing an open-source subproject, or it could be just an internal fork with some confidential parts to it.
You have your external repository. This could be a public repository on GitHub, containing the open-source contributions.
You use software to migrate commits from the internal repository to the external one, and vice versa. Metadata may get added to these migrated commits so the tools can recognize the original commit from a migrated commit. For example, Copybara will add
GitOrigin-RevId: <hash> to the bottom of a commit message.
I’m aware of two tools that do this.
These systems allow you a lot of flexibility in pushing internal changes to public repositories, and accepting public contributions and integrating them into your internal repositories. They are, perhaps, flexible to a fault—you may need to spend some time experimenting with them and trying different configurations.
Also note that these tools are not super well-supported tools with discussion forums. For example, you can’t download a pre-built binary for Copybara, you have to get Bazel to compile it. And you can’t just run fbshipit, you need Hack (Facebook’s PHP derivative, which doesn’t run on all platforms). There is no “Copybara” tag on Stack Overflow.
However, these tools do work and I use them.