how to remove a file from github and stop being tracked?

Question

Though I had added my database.yml into .gitignore, it is still being added at github. Now

1. How should I remove it from github ? (I saw this How to remove files from the GitHub repository?, is this the only way to remove from github?)
2. How to stop it being added at github since it contains sensitive information

Thanks

Answer 1

It sounds like you're asking how to remove the file from the existing history on GitHub.

GitHub's help explains exactly how to do that:

git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch database.yml' --prune-empty --tag-name-filter cat -- --all

Answer 2

Yes that's the way to remove files from Git repositories. Once you'll remove it and since you added this file into your .gitignore file it won't be tracked again. So if you want to keep this file locally, keep a copy somewhere else and then use the git rm path/database.yaml and then put it back.

Note that by adding more rules into the .gitignore file will not affect in any way the files that are already being tracked by git and it only affects the untracked files.

Answer 3

Note that:

• you will find plenty of .gitignore file examples in the GitHub gitignore project.
• yml files are not ignored enough (only Rails.ignore has an *.yml included)
• if you are not careful, you can enable anyone to do a quick grep for sensitive file, with the project ghrabber, in your GitHub repo or any GitHub repo:

That means a simple command is enough to get all sensitive file for all repos:

./ghrabber.py "path:.bash_history"

You get all bash command line history included by mistake in the git repo

./ghrabber.py "path:.htpasswd"

You get all htpasswd files

./ghrabber.py "ext:mbox"

You get mail boxes...

./ghrabber.py "path:databases.yml"

you get connections logins/passwords to database...

(from Korben.info - french)