How to Safely Revert a Commit When You Accidentally Pushed Secrets to Your Git Repository

A Git and A Secret that Accidentally Making A justification

Introduction:

Git is an invaluable tool for collaborative software development but can be a double-edged sword regarding sensitive information. One accidental push of a secret key or token to your public or private repository can have serious consequences. However, with the right approach, you can rectify this situation safely. In this guide, I’ll walk you through the steps to revert a commit that contains sensitive information.

Note: Rewriting Git history can disrupt collaborators, so use these steps cautiously and communicate with your team.

Pre-Requisite

Install git filter-repo on

Mac

$brew install git-filter-repo

Linux

$sudo apt install git-filter-repo

Step 1: Clone the Repository

Begin by cloning the repository to your local machine using the following command:

$git clone <repository_url>

Replace <repository_url> with the URL of your repository. This creates a local copy of your repository on your computer.

Step 2: Navigate to Your Repository

Use the cd command to change your current directory to the repository you just cloned:

$cd <repository_directory>

Replace <repository_directory> with the actual directory name where your repository was cloned.

Step 3: Remove the Sensitive File

Next, we’ll use the git filter-repo command to remove the sensitive file from the commit history. This is a safer and more efficient alternative to git filter-branch. Execute the following command:

$git filter-repo --path <path_to_token_file> --invert-paths --force

Replace <path_to_token_file> With the path to the sensitive information file. This command will filter out the file and its history from your repository.

Step 4: Add Your Repository as a Remote

To push your changes back to the remote repository, you need to add it as a remote, and this is our ‘safety lock’ to ensure it’s pushing to the correct URL remote repository. Use this command to replace <your_repo_url> with the URL of your repository:

$git remote add origin <your_repo_url>

This step ensures you have a reference to the remote repository where you’ll be pushing your changes.

Step 5: Force Push the Changes

It’s time to force-push the changes to your remote repository. This overwrites the commit history, so use it with caution:

$git push origin --force --all

This command forces the changes to all branches in your repository, effectively removing the sensitive information from the remote.

Conclusion:

Accidentally pushing sensitive information to a Git repository can be stressful, but with the right approach, you can fix it securely. These steps allow you to revert a commit that contains secrets, making your repository clean and secure once again. Remember to communicate with your team and use this method judiciously to minimize disruption. Git’s flexibility and robust version control features give you the power to correct mistakes and maintain the integrity of your codebase.