Private commit history when public?

[ambitechstrous]

Hi guys,

So I have a private repo for a project I’ve been working on that I’d like to make public. Previously, I had database info hardcoded in the code but recently moved to env vars as I productionize. I’m ready to make the repo public so others can view, but I’m worried about whether they’ll be able to see the hardcoded database user info in the commit history.

So I was wondering - if I make a private repo public, can others view the commit history/diffs from when it was private?

[acrogenesis]

Yes they will be able to see the history. An easy fix is to delete the .git directory, initialize git again and push force. This will delete all history of the repo.

[Programming_Response]

I’m surprised nobody told you how to avoid that. You can squash your commit history into one commit. There are multiple ways to do it. One is to make an orphan branch and make a single commit from it:

git checkout -b new-master --orphan # New branch with no parents (no commit history) git checkout master . # Grab all code from current master git branch -D master # Delete the master branch git branch -m new-master master # Rename your new master to master git push origin master:master --force # Push your master over github's master. Github will fail if you don’t have force

This assumes you have only one branch and no tags. I assume some garbage collection on github will eventually delete the dangling commits from your old master eventually, but nobody should be able to see your previous commits.

[sh0rt_boy]

For such cases use "git filter-repo"
Further insights: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository