policy auth_error ai_generated true

Error: Push blocked due to secret detected in commit. Secret type: GITHUB_TOKEN. Remove secret from commit history.

ID: policy/github-actions-secret-scanning-blocked-push

Also available as: JSON · Markdown · 中文
80%Fix Rate
85%Confidence
1Evidence
2023-08-15First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
GitHub Enterprise Cloud 2023-12-01 active — — —
GitHub.com as of 2024-03-15 active — — —
GitHub Enterprise Server 3.12 active — — —

Root Cause

GitHub secret scanning is enabled on the repository and detects a hardcoded secret (e.g., GITHUB_TOKEN, AWS access key) in the pushed commit, blocking the push to prevent credential exposure.

generic

中文

仓库启用了 GitHub 密钥扫描，在推送的提交中检测到硬编码密钥（如 GITHUB_TOKEN、AWS 访问密钥），阻止推送以防止凭据泄露。

Official Documentation

https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning

Workarounds

  1. 85% success Use git filter-branch or BFG Repo-Cleaner to remove the secret from commit history, then force push. Example: git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force 
    Use git filter-branch or BFG Repo-Cleaner to remove the secret from commit history, then force push. Example: git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force
  2. 80% success If the secret is non-critical (e.g., test token), rotate the secret and push a new commit without it, then squash the offending commit using interactive rebase (git rebase -i HEAD~N). 
    If the secret is non-critical (e.g., test token), rotate the secret and push a new commit without it, then squash the offending commit using interactive rebase (git rebase -i HEAD~N).
  3. 70% success For GitHub Enterprise, ask an admin to temporarily disable secret scanning for the repository, push the fixed code, then re-enable scanning. 
    For GitHub Enterprise, ask an admin to temporarily disable secret scanning for the repository, push the fixed code, then re-enable scanning.

中文步骤

  1. 使用 git filter-branch 或 BFG Repo-Cleaner 从提交历史中删除密钥，然后强制推送。示例：git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force
  2. 如果密钥非关键（如测试令牌），轮换密钥并推送无密钥的新提交，然后使用交互式变基（git rebase -i HEAD~N）压缩违规提交。
  3. 对于 GitHub Enterprise，让管理员临时禁用仓库的密钥扫描，推送修复后的代码，然后重新启用扫描。

Dead Ends

Common approaches that don't work:

  1. Force push the commit anyway using --force 95% fail

    GitHub's secret scanning blocks the push at the server level; force push is also blocked unless bypassed via repository settings (requires admin).

  2. Rename the file and re-commit without removing the secret 90% fail

    Secret scanning checks the entire commit diff, not just file names; renaming doesn't remove the secret from the content.

  3. Add the secret to .gitignore and re-commit 85% fail

    .gitignore only prevents untracked files from being added; the secret is already in the commit history, so .gitignore has no effect.