Create a policy for deleting PRs that disclose sensitive content

[ckadner]

PRs cannot be deleted/removed by project admins. Only GitHub support staff can. They only do that if sensitive information was disclosed that cannot be easily mitigated, like changing compromised credentials. Even so, the GH support ticket has some turn-around time, so in the meantime, project admins could/should at least hide the sensitive data from the PR's changed files view.

Some key points to follow:

• do NOT close PR or delete source branch yet (important as this would disconnect the PR from the PR source branch and the PR's changed files view remain visible)
• edit/delete the files on the forked branch (clone the fork, checkout the PR's branch, edit the file(s), git amend last commit or reset HEAD~n to revert last n commits, force push)
• now close PR, delete source branch
• the original now orphaned commits can still be found, but it takes some effort and the changed files view no longer shows any of the sensitive information
• edit any comments on the PR with sensitive info and delete the previous versions

FYI @joesepi @russellb @wking

[bjhargrave]

• edit PR title if it contains sensitive information (which may show up in a search)

[joesepi]

These are the notes I have, incorporating comments above

Scrubbing data from issues and pull requests

• title: edit title to remove information
• comment: simply edit or delete a comment; if info is very sensitive and needs to be fully deleted, after editing the comment, use the edit history dropdown menu in the comment to delete previous versions of the comment’s content
• description of issue or pull request cannot be simply deleted, so follow process above to edit and delete history revisions
• code (in pull request files):
  • do NOT close PR or delete source branch yet (important as this would disconnect the PR from the PR source branch and the PR's changed files view remain visible)
  • edit/delete the files on the forked branch (clone the fork, checkout the PR's branch, edit the file(s), git amend last commit or reset HEAD~n to revert last n commits, force push)
  • now close PR, delete source branch
  • the original now orphaned commits can still be found, but it takes some effort and the changed files view no longer shows any of the sensitive information
  • edit any comments on the PR with sensitive info and delete the previous versions

[nathan-weinberg]

cc @RobotSail

[github-actions[bot]]

This issue has been automatically marked as stale because it has not had activity within 90 days. It will be automatically closed if no further activity occurs within 30 days.

[github-actions[bot]]

This issue has been automatically closed due to inactivity. Please feel free to reopen if you feel it is still relevant!