{
  "id": "policy/github-actions-secret-scanning-blocked-push",
  "signature": "Error: Push blocked due to secret detected in commit. Secret type: GITHUB_TOKEN. Remove secret from commit history.",
  "signature_zh": "错误：由于提交中检测到密钥，推送被阻止。密钥类型：GITHUB_TOKEN。从提交历史中移除密钥。",
  "regex": "Push blocked due to secret detected in commit\\. Secret type: .*\\.",
  "domain": "policy",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "GitHub secret scanning is enabled on the repository and detects a hardcoded secret (e.g., GITHUB_TOKEN, AWS access key) in the pushed commit, blocking the push to prevent credential exposure.",
  "root_cause_type": "generic",
  "root_cause_zh": "仓库启用了 GitHub 密钥扫描，在推送的提交中检测到硬编码密钥（如 GITHUB_TOKEN、AWS 访问密钥），阻止推送以防止凭据泄露。",
  "versions": [
    {
      "version": "GitHub Enterprise Cloud 2023-12-01",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "GitHub.com as of 2024-03-15",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "GitHub Enterprise Server 3.12",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Force push the commit anyway using --force",
      "why_fails": "GitHub's secret scanning blocks the push at the server level; force push is also blocked unless bypassed via repository settings (requires admin).",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "Rename the file and re-commit without removing the secret",
      "why_fails": "Secret scanning checks the entire commit diff, not just file names; renaming doesn't remove the secret from the content.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "Add the secret to .gitignore and re-commit",
      "why_fails": ".gitignore only prevents untracked files from being added; the secret is already in the commit history, so .gitignore has no effect.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Use git filter-branch or BFG Repo-Cleaner to remove the secret from commit history, then force push. Example: git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force",
      "success_rate": 0.85,
      "how": "Use git filter-branch or BFG Repo-Cleaner to remove the secret from commit history, then force push. Example: git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force",
      "condition": "",
      "sources": []
    },
    {
      "action": "If the secret is non-critical (e.g., test token), rotate the secret and push a new commit without it, then squash the offending commit using interactive rebase (git rebase -i HEAD~N).",
      "success_rate": 0.8,
      "how": "If the secret is non-critical (e.g., test token), rotate the secret and push a new commit without it, then squash the offending commit using interactive rebase (git rebase -i HEAD~N).",
      "condition": "",
      "sources": []
    },
    {
      "action": "For GitHub Enterprise, ask an admin to temporarily disable secret scanning for the repository, push the fixed code, then re-enable scanning.",
      "success_rate": 0.7,
      "how": "For GitHub Enterprise, ask an admin to temporarily disable secret scanning for the repository, push the fixed code, then re-enable scanning.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "使用 git filter-branch 或 BFG Repo-Cleaner 从提交历史中删除密钥，然后强制推送。示例：git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force",
    "如果密钥非关键（如测试令牌），轮换密钥并推送无密钥的新提交，然后使用交互式变基（git rebase -i HEAD~N）压缩违规提交。",
    "对于 GitHub Enterprise，让管理员临时禁用仓库的密钥扫描，推送修复后的代码，然后重新启用扫描。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning",
  "official_doc_section": null,
  "error_code": null,
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.8,
  "resolvable": "true",
  "first_seen": "2023-08-15",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}