# 错误：由于提交中检测到密钥，推送被阻止。密钥类型：GITHUB_TOKEN。从提交历史中移除密钥。

- **ID:** `policy/github-actions-secret-scanning-blocked-push`
- **领域:** policy
- **类别:** auth_error
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

仓库启用了 GitHub 密钥扫描，在推送的提交中检测到硬编码密钥（如 GITHUB_TOKEN、AWS 访问密钥），阻止推送以防止凭据泄露。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| GitHub Enterprise Cloud 2023-12-01 | active | — | — |
| GitHub.com as of 2024-03-15 | active | — | — |
| GitHub Enterprise Server 3.12 | active | — | — |

## 解决方案

1. ```
   使用 git filter-branch 或 BFG Repo-Cleaner 从提交历史中删除密钥，然后强制推送。示例：git filter-branch --force --index-filter 'git rm --cached --ignore-unmatch path/to/file-with-secret' --prune-empty --tag-name-filter cat -- --all && git push --force
   ```
2. ```
   如果密钥非关键（如测试令牌），轮换密钥并推送无密钥的新提交，然后使用交互式变基（git rebase -i HEAD~N）压缩违规提交。
   ```
3. ```
   对于 GitHub Enterprise，让管理员临时禁用仓库的密钥扫描，推送修复后的代码，然后重新启用扫描。
   ```

## 无效尝试

- **Force push the commit anyway using --force** — GitHub's secret scanning blocks the push at the server level; force push is also blocked unless bypassed via repository settings (requires admin). (95% 失败率)
- **Rename the file and re-commit without removing the secret** — Secret scanning checks the entire commit diff, not just file names; renaming doesn't remove the secret from the content. (90% 失败率)
- **Add the secret to .gitignore and re-commit** — .gitignore only prevents untracked files from being added; the secret is already in the commit history, so .gitignore has no effect. (85% 失败率)