I have a similar process. Internal repo where work gets done. External repo that only gets each release.