12

In order to remove commits from a GitHub repository, the typical advice is to locally remove the commit (e.g., via git rebase -i) and force-push the modified branch over the original remote branch.

However, if the remote branch in question is part of a pull request, GitHub now helpfully displays the message

<user> force-pushed the <remote_branch> branch from <old-commit> to <new-commit>

and displays a link to view the diff between <old-commit> and <new-commit>. (This seems to be a recent change, I do not remember encountering this message before.)

According to another answer here, GitHub should periodically remove commits that are no longer referenced. But since they do reference the old commit in their UI, I suspect they will preserve it. (I haven't seen this apparently new feature for long enough to be sure and have not found any official mention of it yet.)

Is it possible to delete the remote commit in a way that prevents other users from seeing that commit? Or is it at least possible to remove the message above from the PR discussion page? Is there any other way to alter the contents of the underlying branch of a PR without everyone being able to access the old commits from the PR page (at least unless they know the commit hash)?

(This question is not about removing sensitive information such as passwords - I am aware that these should be considered compromised regardless of the possibility of removing the commit afterwards.)

Gabriel Staples
  • 36,492
  • 15
  • 194
  • 265
okwfj
  • 129
  • 1
  • 5
  • I suspect this isn't possible. It's almost like you want the remote repository to run a `git gc`, which is managed automatically. Furthermore, I don't think you'd have access to the remote's `gitconfig`. An answer in https://stackoverflow.com/questions/4212008/forcing-remote-repo-to-compress-gc-with-git has some insight. – miqh Dec 18 '18 at 13:28
  • Possible duplicate of [How to remove a dangling commit from GitHub?](https://stackoverflow.com/questions/4367977/how-to-remove-a-dangling-commit-from-github) – phd Dec 18 '18 at 13:43
  • https://stackoverflow.com/search?q=%5Bgithub%5D+permanently+remove+commit – phd Dec 18 '18 at 13:43
  • @miqh @phd Thanks for the pointers to these answers. Most of what I have read does not seem to be applicable to this specific situation as I have not seen anything addressing the fact that GitHub prominently announces the force push to the world in the PR discussion log (and given the fact that they link to the old commit there, I believe that they are most probably not considering it garbage and won't remove it with equivalent of `git gc` or similar). I guess the most applicable suggestion is "contact GitHub support", but that is probably only a solution for rare cases. – okwfj Dec 18 '18 at 15:49
  • 2
    As of 2018, there is a beta feature for deleting issues, but it does not work for PRs. https://help.github.com/articles/deleting-an-issue/ I'd encourage you to contact GH support. – Jared Beck Dec 18 '18 at 16:06
  • Also related: https://stackoverflow.com/q/51686587/10095231 https://stackoverflow.com/q/872565/10095231 – kelvin May 26 '21 at 18:14

1 Answers1

1

While typically done for expunging sensitive data, this will also work for removing a commit/file. From GitHub's docs:

If you commit sensitive data, such as a password or SSH key into a Git repository, you can remove it from the history. To entirely remove unwanted files from a repository's history you can use either the git filter-branch command or the BFG Repo-Cleaner open source tool.

See above link to the documentation for usage of both.

codenamev
  • 2,203
  • 18
  • 24
  • 7
    The crucial part in the linked docs is probably step 8: "Contact GitHub Support or GitHub Premium Support, asking them to remove cached views and references to the sensitive data in pull requests on GitHub." This could very well be the only solution, but I will wait a bit to see whether someone has another idea. – okwfj Dec 19 '18 at 00:27