如何在我的Android项目中将来自/ res / values的xml文件添加到gitignore中？

Question

I added a separate xml file to my /res/values folder which contains a secret api key that my app uses.

api_key.xml

<?xml version="1.0" encoding="utf-8"?>
<resources>
    <item name="api_key" type="string">my_key</item>
</resources>

Now I would like to exclude it from git. How can I do that?

I added this line to the .gitignore file in my project root

/app/src/main/res/values/api_key.xml

but it does not work. The file still appears on Github after pushing the project content.

Answer 1

Git's ignore system only applies to files that aren't yet tracked. Because you've already committed the file, ignoring it won't do anything.

1. First, and most importantly, invalidate the API secret key.

   You've published it, and there is nothing you can do to make that key secure again. Generate a new key to use going forward. Do not skip this step. There are bots whose purpose in life is to look for leaked API keys on GitHub.

2. Remove the file from Git, probably using git rm --cached app/src/main/res/values/api_key.xml from the root of your repository. This will remove the file from your local repository, but leave it in your local working copy. Because the file is no longer tracked, your ignore will now take effect.

   Update the file with your new API key from step 1.

3. Optionally, add a placeholder file, eg app/src/main/res/values/api_key.xml.sample , to your repository. This file should not include the API key, but rather should be a skeleton of the file you need, eg

    <?xml version="1.0" encoding="utf-8"?> <resources> <item name="api_key" type="string">DUMMY_API_KEY</item> </resources> 

   Developers who work on the project should be encouraged to copy this file to to api_key.xml and add a proper API key.

4. Push to GitHub. The existing file will be removed, and its history will remain in the repository. That's okay, because you've invalidated the leaked API key.

Answer 2

You will have to delete it to remove it from github. The ignore just says "don't include any changes to things that match ..."

This should do it:

git rm --cache api_key.xml

This command says to remove the file from cache, but leave the file in place. I'm pretty sure this will tell Github to remove it from the current head. However, it will not remove the change history.

Back it up if there is any doubt. I'm not responsible ... (lol)