This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

[BlackRam-oss]

Select Topic Area

Question

Feature Area

Issues

Body

A few days ago I accidentally inserted an .env with private credentials into a commiti, in a non-main branch.
a few seconds after I made the commit I also deleted the branch from origin.
"Code scanning alerts" notified me that it found some secrets in a file by attaching the commit link.

The problem is that the branch in which I made the commit has been deleted but clicking on the link proposed by "Code scanning alerts" sends me to a commit that should not exist (https://github.com/DRincs-Productions/xxxxxxx/ commit/xxxxxx).

in fact above it is shown:

(even if I open the link anonymously the commit is shown)

I think it's a mistake. How is it possible that there is a commit that is not linked by any branch? Is there a way to delete the commit?

(as a precaution I made the project private)

Guidelines

• I have read the above statement and can confirm my post is relevant to the GitHub feature areas Issues and/or Projects.

[queenofcorgis]

Thanks for posting in the GitHub Community, @BlackRam-oss !

We're happy you're here. You are more likely to get a useful response if you are posting your question in the applicable category, the Projects and Issues category is solely related to conversations around the GitHub products Issues and Projects. I've gone ahead and moved it for you. Good luck!

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Rockster160]

I've had a similar issue in the past. So far the best way I've seen is to delete the entire repo on Github and then re-push your local repo to it...
There has GOT to be a better way to do it, but I don't know what it is. Subscribing so I get updates in case somebody posts a better way. 👍

[BlackRam-oss]

I understand, but I was hoping this problem would be resolved. also because it is a security problem.

for now to "get around the problem" I made the repo private, but it's not a solution

[Gewerd-Strauss]

Had this happen to me just now. Cleaned up my local repo, only to notice this issue.

Unfortunately for me, deleting the remote would also dump pages, issues and discussions - which are not really restorable to my knowledge. And I need them.

Am I just out of luck here, and must do so? Or is there a way to preserve them?

[BlackRam-oss]

I think it's quicker to change all the tokens (secrets)

[patrick-knight]

Here is our public guidance on removing sensitive data from a repository.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Felixoid]

We faced the same issue. It's possible to set up the monitoring if anything is pushed to a public forks' cloud. But how can we identify where the commit belongs?

In other words, the guide says the ref containing sensitive data must be cleaned. How can we find the sensitive commits in any fork:branch-name?

update

Here's a particular example. Is there an API endpoint to find ClickHouse/ClickHouse@0928a83 in a forks' cloud? Imagine a worse situation: there are many branches on top of this commit, and we need to see them all, so here's an example of the next commit ClickHouse/ClickHouse@c02f98a

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Felixoid]

This is still a crucial part to identify a code that does not l not belong to the main repository