You could always write a script that walks the real commits of your repo and generates fake commits in a public repo with the same timestamps but no meaningful changes or commit messages.

Not yet, waiting for Github to add some fine tune permissions that would ease a lot of worry. You could always create a GIST with exactly what you're comfortable with.