List hidden commits still in Github but not Git (security leak) - github

AWS informed me of leaked account info in a Github repo. It gave me link to the corresponding commit. That commit seems to only be visible if you have the direct sha. I am trying to identify all the other commits that could also contain leaks.
AWS gave the link: https://github.com/myorg/somerepo/commit/1abcdef and that gives me a very old commit with a banner
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
If I try git show 1abcdef on that repo, it's not found. It really cannot be found in git itself. In fact, there is nothing that old.
If I access the commit through the Github API, it is there:
gh api 'repos/myorg/somerepo/commits/1abcdef
I can see all information about it, including the date in 2017.
So I tried:
gh api 'repos/myorg/somerepo/commits?until=2017-12-31'
But that finds nothing. The Github API doesn't seem to mention anything to look at orphaned commits.
I have obviously rotated all credentials for the compromised (dev) account but how can I find other potential problematic commits? If I cannot find them, how could a hacker do it?

Related

Cannot purge commit in a GitHub blob using BFG

I am trying to purge credentials in a file on an Enterprise GitHub repository by following the BFG instructions on a GH article.
I had first used BFG to remove the credentials using a regular (non-mirror) clone for all branches, but realized that this did not purge some historical commits.
So I first tried to purge the mirror clone's commit history as advised by the BFG's documentation. It succeeded but I could not git push --force everything due to remote rejected error for several Pull Requests.
Following the repo admin's advice, we deleted the PRs that were causing the error.
But now BFG fails to correct the issue locally, saying BFG aborting: No refs to update - no dirty commits found??.
Yet, when I visit a commit blob URL(i.e. <github_repo_path>/blob/<commit_id>/<filepath>) on the same repo, it still shows the problematic credentials.
So what allows this commit to be viewable online despite being undetected by BFG?
It is not a local cache issue since it is viewable in Private Mode as well. I emailed GitHub Support to ask if it is a server-side cache but did not hear back yet.
How could I target a specific commit blob? Is there any alternative solution that uses BFG?

Why is Github not picking up my contributions once I've connected my application to Netlify?

I've deployed an app on Netlify through continuous deployment by linking a single Github repo. I had previously been making commits to the project locally, and my contributions were being tracked for this repo. However, now that I've linked the repo to Netlify, it seems no commits or contributions I make are picked up by Github. The commits can still be seen in the Github repo and commits are updated, but the contributions no longer are tracked despite them working previously.
For some context I've checked the Github help page on contributions:
https://help.github.com/en/github/setting-up-and-managing-your-github-profile/why-are-my-contributions-not-showing-up-on-my-profile
And cannot see what rule I've violated; I'm working on this on my own, it's a standalone repo, etc etc. considering they were being tracked before for the same repo, I'm confused as to what has changed now that Netlify has been integrated.
Any help/guidance appreciated
So it had nothing to do with Netlify, but my work Mac did not have me globally installed as the commit author with my email. After that, all previous authors were wrong as being my local computer email.
To get around this I followed this tutorial to replace all previous commits with the correct author: How do I change the author and committer name/email for multiple commits?

Some confusion about the traffic of github repo?

As the pictures show below, the git clones of my repo is 26, and the visitor of my repo is 4. According to the literal meaning, the cloners means who look my repo page and decide to clone my repo to local or somewhere, and also, in the meantime, they should become the visitors of my repo. However, the traffic data of my repo shows that the results of visitors and cloners are much different from each other.
My insight of visitor and coloner is right? What is the GitHub official definition of the cloners and visitors? Or, the significant difference that shows on my picture just caused by the bug of GitHub.
The command git clone http://url will clone the repo without visiting GitHub. Maybe your repo's name is an easy misspelling of another repo, or someone attempted to download all repos by cloning from a list of URLs, looking for loose passwords or doing statistical research.
It could be cloned by you from another IP (other home/TOR/VPN) or you told someone about the repo and someone cloned it without visiting the page.
Do you have a CI/CD server or a DevOps pipeline?
These will clone your repo automatically when triggered by a commit or
a pull request.

Get the user who created a branch with GitHub API

Background
I am using GitHub Enterprise.
I want to check unused branches in my repository, and ask owners of these unused branches to clean-up.
You can see "Your branches" (branches created by current user) on “Branches” page in GitHub. So I think GitHub might have information for who created a branch.
On the other hand, the result of GitHub REST API (https://developer.github.com/v3/git/refs/#get-a-reference) does not contain the creator of the specified branch.
Question
Is there’s any way to get the user who created a branch with GitHub API?
There is no real "ownership" associated to a branch with Git/GitHub.
As mentioned in the documentation, "Your branches" reference in a repository the branches you have push access to, not necessarily the ones you have "created".
The best you can do is, if you have access to a local clone, a simple git fetch, followed by:
git for-each-ref --format="%(committerdate) %09 %(refname:short) %09 %(authorname)" --sort=-committerdate refs/remotes/origin
That will list the remote branches from the most recent updated one to the oldest, with the author of the last commit on each branch.
But if you have to use GitHub API, then you would need to:
list the remote branches,
then for each one get the commit mentioned with the branch
You can then contact the committer of that most recent commit.

Un-fork GitHub project into new GitHub project not associated with the original [duplicate]

How can I make GitHub forget or disassociate that my repo was originally a fork of another project?
I forked a project in GitHub. I can now see "forked from whatever/whatever". The parent repository "whatever/whatever" is no longer maintained. I have been allowed to continue use of the code base of the original repository to create an independent repository.
Is there a way to detach my project from the original repository?
Update Jan 2022:
Use the GitHub chatbot-virtual-assistant at https://support.github.com/contact?tags=rr-forks&subject=Detach%20Fork&flow=detach_fork
First answer:
You can contact github support and ask them to switch your repository to "normal mode".
On this page, "Commit was made in a fork" paragraph, it is explained that one has to go through support to switch. Therefore, it is likely that there is no way to do that by yourself (unless you destroy and recreate your repo which is explained before... if you do so be careful if you have tickets or a wiki attached to your project as they will be deleted!).
You could duplicate the forked repository to a new repository (without the fork dependency) from the GitHub UI, then remove the original forked one:
Sign in to GitHub
Select the + sign in the top right corner and select Import repository.
Import your forked repository. The new repository won't have the fork dependency.
Delete the original, forked repository in the repository settings.
NOTE: This approach will not preserve issues and pull requests.
Make sure you have all the important branches and tags on your local repo, delete the github repo, recreate the repository through usual means (no forking) and push the local repository back with git push --all. Note that if you have local branches that you don't want to publish, might be worth to create a temporary clean local clone for the operation.
However, this will also get rid of wiki and issues. As the wiki is in fact it's own repository, it can be handled similarly by cloning it and then recreating and pushing. The repo address is on wiki's Git Access page (git#github.com:user/repo.wiki.git).
This leaves issues. They can be exported through the API, but as far as I know, you can only create issues and comments with your person, so importing them perfectly is impossible.
So, if you need issues to be preserved, you should go through github support as Thomas Moulard suggests.
I got the similar problem, and ended up using this github help page to solve it. I didn't mind about the wiki and issues tracker as it was for my blog using a theme kindly developed by another user.
To detach a forked repo and use it as your own after several commits without losing the whole history:
git clone --bare git#github.com:user/forked_repo.git
Create a new empty reposity new-repository on the github website.
And push a mirrored version:
cd user.github.com.git/
git push --mirror git#github.com:user/new-repository.git
One can rename on github, the forked_repository with another name to keep it as backup and check updates if needed. Or simply delete it.
Renaming the new-repository to the original name does the job. As a side effect, your commits now appear in your history.
Log in to GitHub with your credentials.
Go to https://support.github.com/contact?tags=rr-forks&subject=Detach%20Fork&flow=detach_fork.
Choose "Detach", then enter the URL or repo name of the fork as your-user-name/repository-name, and answer the other questions of the virtual assistant.
You will get an email with a ticket number where you can check the status of your request. You will also be notified per email once your repo has been deforked.
Most repository settings will stay unchanged, including user permissions, stargazers, issues, PRs, discussions, etc.
Using the info from aurelien and Clayton, I was able to do this with the following:
$ git clone --bare https://github.com/my/forked_repo.git
<delete forked_repo on GitHub>
<recreate repo on GitHub using same name>
$ cd forked_repo.git
$ git push --mirror
Here's the documentation for git clone --bare:
Make a bare Git repository. That is, instead of creating <directory> and placing the administrative files in <directory>/.git, make the <directory> itself the $GIT_DIR. This obviously implies the -n because there is nowhere to check out the working tree. Also the branch heads at the remote are copied directly to corresponding local branch heads, without mapping them to refs/remotes/origin/. When this option is used, neither remote-tracking branches nor the related configuration variables are created.
Here's the documentation for git push --mirror:
Instead of naming each ref to push, specifies that all refs under refs/ (which includes but is not limited to refs/heads/, refs/remotes/, and refs/tags/) be mirrored to the remote repository. Newly created local refs will be pushed to the remote end, locally updated refs will be force updated on the remote end, and deleted refs will be removed from the remote end. This is the default if the configuration option remote.<remote>.mirror is set.
Note: like the other git based answers, this will not copy over issues that are not part of the git repo such as the wiki and issues. Per Tapio:
The wiki is a separate git repo and can be handled in a similar fashion per Tapio. The address is: git#github.com:user/repo.wiki.git.
Issues can be exported via the GitHub API but there are issues recreating them since they can only be created by your user, so imports will lose information.
This only applies to GitHub Enterprise, not on github.com
Logged in to an account that has admin privileges:
Go to the repository that you need to detach: https://<ghe url>/<org>/<repo>
Click on the “Site Admin” rocket on the top right corner
Click "Collaboration" on the top menu bar
Click on “Network” on the left pane
Click on “Make Root” in the Network Structure pane
Accept
This was tested on GitHub Enterprise 2.9
If you do not need any past commits (I didn't in my case), you can just:
fork the project
make a local copy of the fork (I used my IDE to do that)
delete the git folder from your local copy
commit the project as you normally would a new project.
You can just delete the fork from your github account after. Took me all of one minute and worked like a charm.