You only have to put the static content in the public repo which is no different, visibility-wise, than it is going to be anyway. So who cares?

I keep my "uncompiled" site in a private repo that builds and automatically "deploys" by replacing the contents of the public repo and pushing that up. Source is private, final result is public.