ghas-push-protection

Push Protection Remediation

Overview

Resolve push protection blocks caused by detected secrets in commits. Remove the secret from Git history and replace with a secure reference.

Process

1. Identify the blocked commit and the secret type from the push protection error
2. Remove the secret from the commit:
   • If the secret is in the latest (unpushed) commit:

     git reset HEAD~1  # unstage the commit
     # Edit the file to remove the secret
     git add <file>
     git commit -m "fix(security): remove hardcoded secret from <file>"
     

   • If the secret is in older commits:
     • Use git filter-repo (preferred) or BFG Repo Cleaner
     • git filter-repo --path <file> --invert-paths or replace content
3. Replace with secure reference (see ghas-secret-scanning skill)
4. Rotate the credential (see rotation guidance in ghas-secret-scanning)
5. Push the cleaned branch

NEVER

• Never use --bypass-push-protection to skip the check
• Never force-push the secret hoping it won't be detected
• Never add the secret to a push protection bypass list without security team approval