Remove a file from all git history

07/06/2020 - Ted

This will revise the entire git repo history to remove a file that has been accidentally included. eg. API or SSH keys.

$ git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch PATH-TO-YOUR-FILE-WITH-SENSITIVE-DATA" \
  --prune-empty --tag-name-filter cat -- --all

This will:

  • Force Git to process, but not check out, the entire history of every branch and tag
  • Remove the specified file, as well as any empty commits generated as a result
  • Overwrite your existing tags

If those changes had already been pushed to remote, the new commits need to be force-pushed to overwrite the repo.

$ git push origin --force --all

NB: Any cloned repos will need to be re-cloned, or rebased off the new remote.

After ensuring that everything is fine locally, either just clone a new local repo, or wipe out all of the old cruft:

$ git for-each-ref --format="delete %(refname)" refs/original | git update-ref --stdin
$ git reflog expire --expire=now --all
$ git gc --prune=now

https://help.github.com/en/github/authenticating-to-github/removing-sensitive-data-from-a-repository

Tags: