Cleaning out secrets from git repos

README.md

Bare mirror the repository (using example urls)

$ git clone --mirror git://example.com/some-big-repo.git

Mess with the repo (this one removes big files)

$ java -jar bfg.jar --strip-blobs-bigger-than 100M some-big-repo.git

Once you are done with cleanup it will gve a message about cleaning things up. This boils down to expiring the reflog and garbage collecting

$ cd some-big-repo.git
$ git reflog expire --expire=now --all && git gc --prune=now --aggressive

Then comes the missing step from the documentation. First is that you probably have protected branches that you want to overwrite. Go to your online git repository and unprotect them. The other problem is that generically you get extra "fake" refs that you can't push back. First turn off the fact that you have a mirror

$ git config --unset remote.origin.mirror

Then push only heads and tags

$ git push --force refs/heads/*
$ git push --force refs/tags/*

Finally, other developers need to update their copies of the repo with the new version of history. The "fancy" way of doing this is to rebase branches on their remotes.

$ git stash
$ git pull -r
$ git stash pop

The way that I had to do things becuase I was trying to be fancier still (only next needed clenaing in this case) is

$ git checkout main
$ git branch -D next
$ git checkout next

The "burn it to the ground" option is to re-clone the repository.

References:

• github article on removing sensitive data
• git bfg homepage
• git bfg blog article