Why are git private tags and associated private code uploaded to public repositories?

Question

I maintained a git tree which contained numerous branches, some private and some pushed to a public repository at bitbucket. I recently unintentionally discovered that if I tag commits in the private branches, then uploading tags with

git push --tags

leads to all the commits in the private branch and the private tags being uploaded as a dangling tag. This exposed a whole lot of private code that was never intended to be public, leading to me deleting the whole repository and re-uploading it without the offending tags to try and fix the issue.

I've created a sample git tree with only 2 public commits and one private commit in a separate private branch showing how pushing tags pushed the private tag and associated private commit here: https://bitbucket.org/ckolivas/testtag/commits/all PU1 and PU2 were tags made on the master branch and PR1 a tag made on the private branch.

Is this the correct behaviour that wanting to push tags will make it push ALL the tags, even if they're not part of master? It seems counter-intuitive to me.

Answer 1

Is this the correct behaviour that wanting to push tags will make it push ALL the tags, even if they're not part of master? It seems counter-intuitive to me.

Tags has nothing to do with master or any other branch. Tags are simply reference to a commit and indeed you "load" them to the remote using the ``push --tags`

"Private" branches are local branches which are not published to remote repository.
"Public" branches are branches in the remote repository.

---

Best practice

If you use tags prefer the annotated tag git tag -a over the "regular tag" git tag . It will create annotated tag with the same info as commit so you can view it later on.

---

From the git push documentation:

git push --follow-tags

You can also use the git push --follow-tags to push all your tags

--follow-tags

Push all the refs that would be pushed without this option, and also push annotated tags in refs/tags that are missing from the remote but are pointing at commit-ish that are reachable from the refs being pushed.

This can also be specified with configuration variable push.followTags .
For more information, see push.followTags in git-config .

--tags

All refs under refs/tags are pushed, in addition to refspecs explicitly listed on the command line.

Answer 2

This is the correct bahaviour, since you are uploading all tags. If you wish to only upload tags associated with some "public" branches, then list those tags explicitly, like

git push some_remote some_public_tag

Answer 3

Fom the documentation for git push :

--tags

All refs under refs/tags are pushed, in addition to refspecs explicitly listed on the command line.

So, yes, git push --tags pushes all tags.