执行 git pull 时如何忽略 Github 上的文件

Question

I am using Ruby on Rails 4, Ruby 2.2.2, and deploying to Heroku. I have my secret variables configured with Heroku config:set and I want to use Rails.application.secrets.secret_key to access my secrets.

What is the best way to manage my config/secrets file with Git and GitHub while developing and deploying to Heroku? I have my config file as follows:

development:
  secret_key_base:    <value>

test:
  secret_key_base:    <value>

# Do not keep production secrets in the repository,
# instead read values from the environment.
production:
  secret_key_base:           <%= ENV["SECRET_KEY_BASE"] %>
  # Amazon credentials
  s3_bucket_name:            <%= ENV["S3_BUCKET_NAME"] %>
  aws_secret_access_key:     <%= ENV["AWS_SECRET_ACCESS_KEY"] %>
  aws_access_key_id:         <%= ENV["AWS_ACCESS_KEY_ID"] %>
  aws_region:                <%= ENV["AWS_REGION"] %>
  aws_cloud_front:           <%= ENV["AWS_CLOUD_FRONT"] %>

  # Twitter credentials
  twilio_token: <%= ENV["TWILIO_TOKEN"] %>
  twilio_sid:   <%= ENV["TWILIO_SID"] %>
  twilio_number: <%= ENV["TWILIO_NUMBER"] %>

I had pushed changes to my file even with it in the .gitignore file because it had been tracked by Git in the past. I stopped tracking my config/secrets.yml file on Git, so I don't push changes, but when I pull down from master my config/secrets file is overridden with only the production credentials.

Answer 1

Completely removing a file from a git repository can be done, but it is tedious.

You can easily remove it from the current files, though. Delete it with git rm yourfile and commit and push that. That will delete your local file, so you might want to copy it first. You can add it back after you commited the deletion.

Note that .gitignore does not concern files that are already under version control. Explicitly removing such files works however. The copy should not be tracked any more.

Answer 2

Git doesn't provide a means for partial pulls however in your situation all you need to do is define your environment variable keys with the same name for both your production and your development. Doing so will allow you to leave the file alone and utilize the values keys on both your local and your production environments without making changes any changes. If you want to push new commits without pushing any changes to this file you can do that by using

git update-index --asume-unchanged <filenameHere>

This will allow you to keep this file in your local without pushing it to git with the rest of your changes. Unfortunately there's no way I know of to do the opposite and exclude certain files on the pull.

Answer 3

If there are secrets in the file that you have committed that you cannot easily change / rotate, there are a couple of ways to completely remove previously committed sensitive information from git.

The Github guide has a good article for this.