📝 Originally published (in Japanese) at forge.workstyle.tech.

TL;DR I was preparing to release Voice Canvas as OSS and found that an old commit URL still opened in my account after I squashed the Git history into 1 commit. The repository was private, and the same URL returned 404 when I was logged out. Since that did not confirm what would happen after publication, I recreated the repository before making it public.

Conclusion First

Even after squashing a Git history into a single commit, I could open an old commit URL while logged in to my account on a private repository. I recreated the repository with the same name and made it public, then confirmed that the old URL could not be opened while logged out. I did not test whether the old commit would be visible after making the repository public.

Why an Old URL Still Opened After I Squashed the History

I squashed Voice Canvas’s history into a single commit because it contained information I didn’t want to leave in the old history. After squashing, I opened the URL for an old commit while signed in to my account, and the commit appeared.

At that point, the repository was private. The same URL returned a 404 (page not found) when I wasn’t logged in. Since I could still see it from my own account, I realized that a 404 while logged out didn’t tell me what the URL would show after the repository became public.

I thought the old commit might be visible if I made the repository public, but I didn’t actually make it public to find out. Instead of gambling on what would be visible afterward, I decided to recreate the repository before publishing it.

What Happened When I Recreated a Repository with the Same Name and Sent Changes

I deleted a repository, recreated it with the same name, and published it. My push (the operation that sends changes to a repository) was rejected once. The message said the author’s email address was blocked by the email privacy setting.

push declined due to email privacy restrictions

I changed the author’s address to a noreply address and pushed again. This time it went through. In my case, the snag after recreating the history was the email address setting.

How I Checked the Old Commit URL After Publishing

After publishing, I used a ruleset (the repository’s rules configuration) to block force pushes to main. I tried it and confirmed that the push was rejected.

On October 16, I opened the old commit URL while logged out, and it no longer loaded. The current public repository has three commits in its history.

What I confirmed was that the old URL, after recreating the repository, could not be opened while logged out. Before recreating it, the private repository returned a 404 when I was logged out, but the commit was visible when I was signed in to my own account. I still haven’t confirmed whether the old commit is visible when the repository is public.

Key takeaways

  • After squashing history into 1 commit, check the old commit URL while signed in and logged out.
  • A 404 while logged out from a private repository does not establish what happens when it is public.
  • After recreating and publishing the repository, check the old URL while logged out.
  • If a push is declined, check the reason and author email settings; in my case, a noreply address worked.
  • Verify that force pushes to main are prohibited by trying one.