Git Multiverse: View deleted git histories on GitHub
PSA: You can view deleted commits on a @GitHub repository, even if you force-push the whole repository. ⚠️
This is my commit history for my website: github.com/grikomsn/personal-websites/commits/main
This commit history does not exist on my repository: github.com/grikomsn/personal-websites/commits/106baefac869ba1049b3100a1cab6313efaaa5cd
(read more below)
I have force-pushed my repo many times, assuming that previous histories are deleted. Here are different commit histories which should not exist:
github.com/grikomsn/personal-websites/commits/106baefac869ba1049b3100a1cab6313efaaa5cd
github.com/grikomsn/personal-websites/commits/e4c856f44bb90b88f7ba8de16643dd0db0477a46
github.com/grikomsn/personal-websites/commits/1c43f7819656ac8a73259cc163b627af7dc1816f
Here are more commit histories which should not exist:
github.com/grikomsn/personal-websites/commits/8bd406afadb20fec9bba8d8cdb8cafd1b65c30f2
github.com/grikomsn/personal-websites/commits/5b85058dea5ce4b8d73d6d3c95460e74dd6c039b
github.com/grikomsn/personal-websites/commits/d2f2d849931f5965c75b4f47571387a2b84900f2
Theoretically, if someone tracks all commit hashes for a repo on @GitHub, they can view the repo's past, present, and future history, regardless if it has been replaced or deleted.
This is basically a git multiverse. ✨
One solution I can find to remove all references is from their docs page:
"Contact GitHub Support, asking them to remove cached views and references to the sensitive data in pull requests on GitHub"
docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository#fully-removing-the-data-from-github
I have asked @GitHubHelp (ticket 1466521) if it's possible to clear these dangling references.
Sadly there's no way to remove those unless all forks are removed, which it will never happen anytime soon.
I guess there's a reason why we don't mess with the multiverse.