# Error: Push blocked due to secret detected in commit. Secret type: GITHUB_TOKEN. Remove secret from commit history.

- **ID:** `policy/github-actions-secret-scanning-blocked-push`
- **Domain:** policy
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

GitHub secret scanning is enabled on the repository and detects a hardcoded secret (e.g., GITHUB_TOKEN, AWS access key) in the pushed commit, blocking the push to prevent credential exposure.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| GitHub Enterprise Cloud 2023-12-01 | active | — | — |
| GitHub.com as of 2024-03-15 | active | — | — |
| GitHub Enterprise Server 3.12 | active | — | — |

## Workarounds

1. **Use git filter-branch or BFG Repo-Cleaner to remove the secret from commit history, then force push. Example: git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force** (85% success)
   ```
   Use git filter-branch or BFG Repo-Cleaner to remove the secret from commit history, then force push. Example: git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force
   ```
2. **If the secret is non-critical (e.g., test token), rotate the secret and push a new commit without it, then squash the offending commit using interactive rebase (git rebase -i HEAD~N).** (80% success)
   ```
   If the secret is non-critical (e.g., test token), rotate the secret and push a new commit without it, then squash the offending commit using interactive rebase (git rebase -i HEAD~N).
   ```
3. **For GitHub Enterprise, ask an admin to temporarily disable secret scanning for the repository, push the fixed code, then re-enable scanning.** (70% success)
   ```
   For GitHub Enterprise, ask an admin to temporarily disable secret scanning for the repository, push the fixed code, then re-enable scanning.
   ```

## Dead Ends

- **Force push the commit anyway using --force** — GitHub's secret scanning blocks the push at the server level; force push is also blocked unless bypassed via repository settings (requires admin). (95% fail)
- **Rename the file and re-commit without removing the secret** — Secret scanning checks the entire commit diff, not just file names; renaming doesn't remove the secret from the content. (90% fail)
- **Add the secret to .gitignore and re-commit** — .gitignore only prevents untracked files from being added; the secret is already in the commit history, so .gitignore has no effect. (85% fail)