Bare mirror the repository (using example urls)
$ git clone --mirror git://example.com/some-big-repo.git
Mess with the repo (this one removes big files)
$ java -jar bfg.jar --strip-blobs-bigger-than 100M some-big-repo.git
Once you are done with cleanup it will gve a message about cleaning things up. This boils down to expiring the reflog and garbage collecting
$ cd some-big-repo.git
$ git reflog expire --expire=now --all && git gc --prune=now --aggressive
Then comes the missing step from the documentation. First is that you probably have protected branches that you want to overwrite. Go to your online git repository and unprotect them. The other problem is that generically you get extra "fake" refs that you can't push back. First turn off the fact that you have a mirror
$ git config --unset remote.origin.mirror
$ git push --force refs/heads/*
$ git push --force refs/tags/*
Finally, other developers need to update their copies of the repo with the new version of history. The "fancy" way of doing this is to rebase branches on their remotes.
$ git stash
$ git pull -r
$ git stash pop
The way that I had to do things becuase I was trying to be fancier still (only next
needed clenaing in this case) is
$ git checkout main
$ git branch -D next
$ git checkout next
The "burn it to the ground" option is to re-clone the repository.
References:
- github article on removing sensitive data
- git bfg homepage
- git bfg blog article