policy auth_error ai_generated true

错误：由于提交中检测到密钥，推送被阻止。密钥类型：GITHUB_TOKEN。从提交历史中移除密钥。

Error: Push blocked due to secret detected in commit. Secret type: GITHUB_TOKEN. Remove secret from commit history.

ID: policy/github-actions-secret-scanning-blocked-push

其他格式: JSON · Markdown 中文 · English
80%修复率
85%置信度
1证据数
2023-08-15首次发现

版本兼容性

版本状态引入弃用备注
GitHub Enterprise Cloud 2023-12-01 active — — —
GitHub.com as of 2024-03-15 active — — —
GitHub Enterprise Server 3.12 active — — —

根因分析

仓库启用了 GitHub 密钥扫描，在推送的提交中检测到硬编码密钥（如 GITHUB_TOKEN、AWS 访问密钥），阻止推送以防止凭据泄露。

English

GitHub secret scanning is enabled on the repository and detects a hardcoded secret (e.g., GITHUB_TOKEN, AWS access key) in the pushed commit, blocking the push to prevent credential exposure.

generic

官方文档

https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning

解决方案

  1. 使用 git filter-branch 或 BFG Repo-Cleaner 从提交历史中删除密钥，然后强制推送。示例：git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force
  2. 如果密钥非关键（如测试令牌），轮换密钥并推送无密钥的新提交，然后使用交互式变基（git rebase -i HEAD~N）压缩违规提交。
  3. 对于 GitHub Enterprise，让管理员临时禁用仓库的密钥扫描，推送修复后的代码，然后重新启用扫描。

无效尝试

常见但无效的做法:

  1. Force push the commit anyway using --force 95% 失败

    GitHub's secret scanning blocks the push at the server level; force push is also blocked unless bypassed via repository settings (requires admin).

  2. Rename the file and re-commit without removing the secret 90% 失败

    Secret scanning checks the entire commit diff, not just file names; renaming doesn't remove the secret from the content.

  3. Add the secret to .gitignore and re-commit 85% 失败

    .gitignore only prevents untracked files from being added; the secret is already in the commit history, so .gitignore has no effect.