How to permanently remove (or hide) a commit from a GitHub PR after force pushing

Question

In order to remove commits from a GitHub repository, the typical advice is to locally remove the commit (e.g., via git rebase -i) and force-push the modified branch over the original remote branch.

However, if the remote branch in question is part of a pull request, GitHub now helpfully displays the message

<user> force-pushed the <remote_branch> branch from <old-commit> to <new-commit>

and displays a link to view the diff between <old-commit> and <new-commit>. (This seems to be a recent change, I do not remember encountering this message before.)

According to another answer here, GitHub should periodically remove commits that are no longer referenced. But since they do reference the old commit in their UI, I suspect they will preserve it. (I haven't seen this apparently new feature for long enough to be sure and have not found any official mention of it yet.)

Is it possible to delete the remote commit in a way that prevents other users from seeing that commit? Or is it at least possible to remove the message above from the PR discussion page? Is there any other way to alter the contents of the underlying branch of a PR without everyone being able to access the old commits from the PR page (at least unless they know the commit hash)?

(This question is not about removing sensitive information such as passwords - I am aware that these should be considered compromised regardless of the possibility of removing the commit afterwards.)

Answer 1

While typically done for expunging sensitive data, this will also work for removing a commit/file. From GitHub's docs:

If you commit sensitive data, such as a password or SSH key into a Git repository, you can remove it from the history. To entirely remove unwanted files from a repository's history you can use either the git filter-branch command or the BFG Repo-Cleaner open source tool.

See above link to the documentation for usage of both.