Need to remove email address from commit history associated with closed PRs

[bensullivan2002]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Discussion Details

I have a private, personal repo which I want to make public (with MIT licence). Unfortunately, I accidentally made some commits using my work email address, despite the repo having nothing to do with work, containing no code associated with work, and having been done outside work hours. I am hesitant to make the repo public and add a licence with the work email address in the commits, but I can't edit commit metadata for closed PRs. Any way I can get the email address removed? I have fixed things for future commits and can re-write history for commits not part of closed PRs, so that's not a problem. It's just the read-only commits I'm struggling with.

[adi785]

Yes, you can absolutely remove your work email address from your entire repository history, including commits that were part of closed Pull Requests..

Step1:- Backup your Repo
Step2:- Use git-filter-repo
Step3:- Force-Push the changes

[bensullivan2002]

Unfortunately the force-push doesn't address metadata as part of refs/pull/*/head, and it's those I want to be rid of.

[Sarvagya-24-chaturvedi]

Hi @bensullivan2002,

You cannot directly modify commit metadata inside closed Pull Requests because GitHub stores immutable internal references (refs/pull/<id>/head) and cached commit objects that standard git push --force cannot overwrite.

Since this is a private personal repository that hasn't been shared or made public yet, the definitive and cleanest solution is to rewrite the history locally, push it to a clean repository, and delete the old one. This completely purges all closed PRs and cached commit history.

Here are the complete steps:

Step 1: Install git-filter-repo and rewrite the email locally

pip install git-filter-repo
git filter-repo --email-callback '
    return email.replace(b"work@company.com", b"personal@example.com")
'

Step 2: Verify all traces of the work email are gone

git log --all --format='%ae %ce' | sort -u

(Make sure only your desired personal email appears in the output.)

Step 3: Create a fresh repository on GitHub

Create a new empty repository on GitHub (or delete your current private repo and re-create an empty one with the exact same name).

Step 4: Point to the new repository and push

git remote set-url origin git@github.com:bensullivan2002/<repo-name>.git
git push -u origin --all
git push -u origin --tags

Step 5: Delete the old private repository

Deleting the old repository permanently purges all closed PR references, commit caches, and metadata from GitHub's servers. Your new repository can now safely be set to public with your MIT license attached.

[bensullivan2002]

Thanks, this is what I feared. I was getting the vibe I was going to have to resort to the new repo option. It has its own downsides, but hey ho. It's frustrating because the references aren't truly immutable - GitHub staff have write access (even though us mere mortals only have read access). At least, so far as I'm aware. That's how genuinely sensitive data can be removed from repos that can't easily just be mirrored to a new one. But as a lone operator using a personal repo on a free tier, the juice is clearly not worth the squeeze. To be fair, that does seem reasonable, I guess, for a free service.

[Sarvagya-24-chaturvedi]

You're completely right on all counts, Ben. GitHub staff do have internal tools to force-purge backend cached refs, but going through the support ticketing queue for a non-enterprise repo can take weeks definitely not worth the hassle when a fresh push takes under two minutes.
Look at it this way: starting with a clean slate ensures you have absolute zero ghost references or cached metadata lingering on GitHub's servers before you flip the visibility to public.
Best of luck with open-sourcing the project and releasing it under the MIT license!

[metopism]

The commits themselves don't actually contain your email address in a way that's publicly visible on GitHub — the email is stored in the git metadata but GitHub only displays it if the email isn't associated with a private account or if you have email privacy disabled. If you go to Settings > Emails and make sure "Keep my email address private" is on, GitHub will mask it in the web interface even on public repos.

That said if you're worried about someone cloning the repo and running git log to pull the raw metadata, that's a legitimate concern and the only real fix is a history rewrite. For the closed PR commits specifically, GitHub support can help with removing sensitive data from repository history — there's a documented process at docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository using git-filter-repo, and if the PR closure is what's blocking you from doing it yourself, contacting support directly is the escalation path.

[bensullivan2002]

Thank you metopism, understood, but unfortunately, as I don't have a paid-for account, that's not an option. GitHub Supoprt for that sort of thing appears to require a paid-for tier.