divekit history redact
Replace literal strings in the history of all repositories
Synopsis
Replace the literal strings of a file in the whole history of the repositories of a distribution, where the surrounding files must remain. Values are literal, never patterns. They are never printed, logged or stored: the run file keeps salted fingerprints only, so a resume needs the original file again until the rewrite is verified.
The steps are those of history remove. Matching is exact and case sensitive and covers file content only: commit messages, ref names and encoded variants of a value are not touched.
Usage
divekit history redact [flags]
Examples
divekit history redact -d ST2M4 --literal-file leaked-values.txt --dry-run
divekit history redact -d ST2M4 --literal-file leaked-values.txt
Flags
-d, --distribution string Distribution name
-n, --dry-run Make the inventory and show the complete plan without changing GitLab
--exclude-blocked Continue without the repositories that fail preflight (forks, missing Owner role, unreadable repositories). They stay untouched and exposed
--literal-file string Text file with one literal string to replace per line. The values are never printed or stored
-r, --remote string Remote repository URL (e.g. GitLab instance)
--target stringArray Narrow the scope to this target, for example work or eval (repeatable). The default is every recorded target
-t, --token string GitLab token or token file path (file:///...)
--uuid stringArray Narrow the scope to the repository with this UUID (repeatable). The default is every recorded repository
Inherited Flags
-l, --loglevel string log level (debug, info, warn, error, fatal) (default "info")
--no-index skip project index update
--non-interactive run in non-interactive mode (fails if interactive input is required)
-y, --yes assume yes/default for all prompts (non-interactive with automatic defaults)