Removing specific data from source control is a vital practice for maintaining a secure and clean project environment. When sensitive details like passwords, API keys, or massive unneeded files are committed to a Git repository, simply deleting them in a new commit does not solve the problem because the data still exists in the commit history. To protect the project, developers must rewrite the history to erase all past traces of this data. In Azure Repos, running these processes ensures that compromised credentials or extraneous files are permanently removed from cloud storage.
Several specialized tools exist to help developers modify past commits and purge unwanted data. The modern tool of choice is git filter-repo, which is highly recommended because it performs history rewrites quickly and safely. An older built-in option is git filter-branch, which allows for highly customized rewriting tasks but is slower and more complex to use. For teams looking for a simpler alternative, the BFG Repo-Cleaner is a fast third-party tool specifically designed to target and strip out large files or credentials.
After a developer successfully rewrites the history on their local machine, they must update the remote repository in Azure Repos. Because the local history no longer matches the cloud version, the developer must perform a force-push to overwrite the old commits. This action can easily disrupt the work of other team members who are working on the same codebase, so it is critical to notify and coordinate with the team beforehand. Once the push is complete, the team must verify that the cloud repository successfully synchronizes and no longer contains the removed data.
A process flow showing the steps to safely rewrite Git history, from identifying sensitive data to coordinating with the team and force-pushing the cleaned history to Azure Repos.
Seeking the thrill of transformative tech? Explore the art of designing and implementing DevOps solutions on Azure. Master the shift towards CI/CD, testing, and delivery, while preparing for the Designing and Implementing Microsoft DevOps Solutions exam!
Prepare and test your skills
Prepare and test your skills
Deleting a file in a new commit does not solve the issue because the data still exists in the repository commit history. Developers must rewrite the repository history to permanently erase all past traces of sensitive credentials or large unneeded files from cloud storage.
Developers can use git filter-repo, which is the recommended modern tool for fast and safe history rewrites, or the older built-in git filter-branch for complex, customized tasks. Alternatively, the third-party BFG Repo-Cleaner provides a fast option designed specifically to strip out credentials and large files.
Developers must perform a force-push to update Azure Repos because the rewritten local history no longer matches the cloud version. Because this action can disrupt other team members working on the codebase, it requires prior notification and coordination, followed by verification that the cloud repository no longer contains the purged data.
StudyCerts
StudyCerts