This post has been republished via RSS; it originally appeared at: Azure Developer Community Blog articles.
Remove Azure Secrets committed to GitHub
Remove passwords committed to GitHub on accident
Writing code day after day means secrets, connection strings and more get added to your code accidentally. And if you are like me, they get committed to your GitHub repo and then you have to live in shame. =) In this post, I'll walk you through removing secrets from a GitHub repo that you've already committed the secret to.
Part 1 - Initial setup:
Scenario: You have committed a password with the value of qph@}uC,7cGLBdsX
to your GitHub repo. This password should be confidential and not stored in the code.
How do you fix it?
- Ensure you have the repo on your local disk or clone a fresh copy with HTTPS or SSH. I'll use SSH
git clone git@github.com:mbcrump/crumpbot.git
as a sample. - Clone a copy of your repo that has the secret stored using the mirror option, like the following
git clone --mirror git@github.com:mbcrump/crumpbot.git
. - You'll now have a BARE repo. CD into it with
cd crumpbot.git
and runls -l
to list out the contents on macOS ordir
on Windows.
Below is an example of my repo.
Part 2 - Create a file of passwords that you'd like to remove:
- Create a
passwords.txt
file and place and enter the passwords that you'd like to remove from your GitHub repo.
I created mine on macOS with touch passwords.txt
or echo some-text > passwords.txt
on Windows and added the password that I accidentally committed:
- Save the file.
Part 3 - Install BFG:
Enter BFG (opens new window). According to the author:
BFG is a simpler, faster alternative to git-filter-branch for cleansing bad data out of your Git repository history: Removing Crazy Big Files Removing Passwords, Credentials & other Private data
- Install BFG with
brew install bfg
assuming you have Homebrew installed and using a Mac or download the JAR file if you are on Windows.
Part 4 - Clean up the passwords previously committed:
-
Run
bfg --replace-text passwords.txt crumpbot.git
on Mac orjava -jar bfg.jar --replace-text passwords.txt crumpbot.git
if using the JAR file. -
Below is output from that command:
Part 5 - Pushing to GitHub:
- Run
git reflog expire --expire=now --all && git gc --prune=now --aggressive
as indicated by the output. - Run
git push
to push it to your repo.
Part 6 - Wrap-up and verify your repo was updated successfully:
If you go back to your GitHub repo and look at prior commits, then you should see REMOVED like the following:
I hope this helps someone out there and if you want to stay in touch then I can be found on Twitch, Twitter or GitHub.
Create a trial account today and go and check it out!