This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

[BlackRam-oss]

Select Topic Area

Question

Feature Area

Issues

Body

A few days ago I accidentally inserted an .env with private credentials into a commiti, in a non-main branch.
a few seconds after I made the commit I also deleted the branch from origin.
"Code scanning alerts" notified me that it found some secrets in a file by attaching the commit link.

The problem is that the branch in which I made the commit has been deleted but clicking on the link proposed by "Code scanning alerts" sends me to a commit that should not exist (https://github.com/DRincs-Productions/xxxxxxx/ commit/xxxxxx).

in fact above it is shown:

(even if I open the link anonymously the commit is shown)

I think it's a mistake. How is it possible that there is a commit that is not linked by any branch? Is there a way to delete the commit?

(as a precaution I made the project private)

Guidelines

• I have read the above statement and can confirm my post is relevant to the GitHub feature areas Issues and/or Projects.

[queenofcorgis]

Thanks for posting in the GitHub Community, @BlackRam-oss !

We're happy you're here. You are more likely to get a useful response if you are posting your question in the applicable category, the Projects and Issues category is solely related to conversations around the GitHub products Issues and Projects. I've gone ahead and moved it for you. Good luck!

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Rockster160]

I've had a similar issue in the past. So far the best way I've seen is to delete the entire repo on Github and then re-push your local repo to it...
There has GOT to be a better way to do it, but I don't know what it is. Subscribing so I get updates in case somebody posts a better way. 👍

[BlackRam-oss]

I understand, but I was hoping this problem would be resolved. also because it is a security problem.

for now to "get around the problem" I made the repo private, but it's not a solution

[Gewerd-Strauss]

Had this happen to me just now. Cleaned up my local repo, only to notice this issue.

Unfortunately for me, deleting the remote would also dump pages, issues and discussions - which are not really restorable to my knowledge. And I need them.

Am I just out of luck here, and must do so? Or is there a way to preserve them?

[BlackRam-oss]

I think it's quicker to change all the tokens (secrets)

[patrick-knight]

Here is our public guidance on removing sensitive data from a repository.

[AbdulRehma4545]

Bitget account Google Authenticator code

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Felixoid]

We faced the same issue. It's possible to set up the monitoring if anything is pushed to a public forks' cloud. But how can we identify where the commit belongs?

In other words, the guide says the ref containing sensitive data must be cleaned. How can we find the sensitive commits in any fork:branch-name?

update

Here's a particular example. Is there an API endpoint to find ClickHouse/ClickHouse@0928a83 in a forks' cloud? Imagine a worse situation: there are many branches on top of this commit, and we need to see them all, so here's an example of the next commit ClickHouse/ClickHouse@c02f98a

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Felixoid]

This is still a crucial part of identifying a code that does not belong to the main repository

[yakimant]

Related article:
https://trufflesecurity.com/blog/anyone-can-access-deleted-and-private-repo-data-github

[kshetline]

I've got this problem now too. I see a lot of responses here have to do with concerns about sensitive data, and commits which shouldn't have been made, but I don't have any of those worries.

All of the content shown to be in my repo is as it should be. The warning "This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository" makes no sense to me.

[kshetline]

Some stupid games with copy branches and changing the default branch and deleting branches and renaming branching and deleting tags, etc., etc. cleared up the problem.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Felixoid]

I'll try my best not to allow this sinking. The issue of identifying the source of the commit is still real. The support can do it, so let's make the handler public in the API.

[mobiuscreek]

This appeared after running git filter-repo and git force push to remove sensitive data. Searching for the sensitive data via the search bar in the UI reveals the deleted data in a commit that otherwise doesn't exist. Reading the github guidelines the solution is to contact support but wouldn't it save working hours if this was implemented in the API instead? Maybe even just using the github cli.

[Felixoid]

In this case, the GH staff simply run git gc to remove the stale data. Usually, it's a destructive operation, cleaning out all the stuff remaining after git push --force operation to PRs and so on.

Personally, I'm OK with contacting support for such cases.

The issue is about identifying objects in other repositories. Now it's impossible.

[lukehutch]

git gc followed by git push did not remove the disconnected commit in my case.