secret scanning push protection blocked the PR branch push

TL;DR

Push protection rejected your push because a commit contains something that looks like a secret. Remove the secret from the commits (rewrite history on the branch), rotate the exposed credential, then push again.

Error

remote: error: GH013: Repository rule violations found for refs/heads/feature.
remote: - Push cannot contain secrets

Steps

1. Identify the secret value the rejection names the file and the secret type. Expected: you know which commit and file contain it.
2. Rotate the credential immediately - assume it is compromised the moment it was committed. Expected: the old value no longer works.
3. Remove it from the branch history: git rebase -i to edit the offending commit, or start the branch over if the history is messy. Expected: no commit on the branch contains the secret.
4. Push the rewritten branch. Expected: push protection passes.

When to use

• GitHub push protection rejects the push with GH013 / 'Push cannot contain secrets'.
• The secret is in commits on your branch.

When not to use

• You need a bypass approval - that is the bypass workflow, not the removal workflow.
• The detection is a false positive on a placeholder; use the 'allow secret' flow in the UI.

Tool compatibility

• GitHub secret scanning with push protection enabled.
• Git 2.x.

Variant phrasings

Secret in an old commit deep in history

Use an interactive rebase or filter-repo to remove it from every commit.

False positive on a test fixture

Mark it as allowed in the security alert UI instead of rewriting history.

Why it happens

Push protection scans the pushed commits for secret patterns before accepting them. A rejection means the secret would otherwise land in the repo history, where it is effectively public to anyone with read access.

Edge cases

• Rewriting history requires force-push; coordinate if others share the branch.
• Rotation is not optional - the secret was exposed the moment the commit existed, even if the push was blocked.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_jxbjMn3bqwX5dJaYY4ED-g