如何从GitHub完全删除敏感提交？

Question

A few days ago I read article about Github's privacy basics and it says commiters' email are visible via simple Github API request.

I set email alias, but I want to changed email for past commits. Tried with this site and this alias for .gitconfig

change-commits = "!f() { VAR1=$1; VAR='$'$1; OLD=$2; NEW=$3; 
  echo \"Are you sure for replace $VAR $OLD => $NEW ?(Y/N)\";
  read OK;
  if [ \"$OK\" = 'Y' ] ; 
  then shift 3; 
  git filter-branch --env-filter \"if [ \\\"${VAR}\\\" = '$OLD' ]; 
  then export $VAR1='$NEW';echo 'to $NEW'; fi\" $@; fi;};f " 

After that steps when I'll type git log and every commit has new mail, but after API call https://api.github.com/users/(usuername)/events/public I see both old and new email

Answer 1

As commented , you cannot really "change" a commit, only create a new one with the same or similar data. So when you do a git filter-branch , git rebase or any other form of amend , you are still creating new commits .

And when running git push -f , the only difference is that the remote branch reference is force-updated ; it still sends new commits and what is to be done with the old commits (if anything) is up to the remote repository.

In the case of GitHub , it does not immediatelly remove those old commits from the repository when you do a forced push .

From the official GitHub Help :

Warning: Once you have pushed a commit to GitHub, you should consider any data it contains to be compromised. If you committed a password, change it! If you committed a key, generate a new one.

This article tells you how to make commits with sensitive data unreachable from any branches or tags in your GitHub repository. However, it's important to note that those commits may still be accessible in any clones or forks of your repository, directly via their SHA-1 hashes in cached views on GitHub, and through any pull requests that reference them. You can't do anything about existing clones or forks of your repository, but you can permanently remove all of your repository's cached views and pull requests on GitHub by contacting GitHub Support.

So, to make the old commits stop appearing in the API in a reasonable time-frame, the only options are:

Warning : While the former option is faster , it will also delete the wiki , issues and comments .

• Delete the repository and create a new one
• Contact GitHub support to manually run git gc on the hosted repository

---

Note : There is a more comprehensive explanation of the implications of dangling commits here:

https://stackoverflow.com/a/32840254/10095231

Answer 2

I would use git bfg for this.

Works really well and is easy to use as well. It will completely remove what you need removed from the git history.

Git BFG Docs