Git main branch contains accidental commits

[BartButenaers]

Hi folks,

I have been doing quite a lot of work in the last week for the dashboard repo, but it seems I have (by accident) pushed some stuff to my main branch. Now the main branch is two commits ahead of the dashboard project:

Does anybody know how I can fix this? Because when I create now a new branch, the pull request also shows extra changed files

First I was 3 commits ahead, but I managed to get rid of that by a git reset --hard 01e71c66cd33675f93d654853b87aa3016718a17 command.

But that fails for my other two commits:

xxx@yyy:~/node-red-dashboard/nodes/config $ git revert 01e71c66cd33675f93d654853b87aa3016718a17
error: commit 01e71c66cd33675f93d654853b87aa3016718a17 is a merge but no -m option was given.
fatal: revert failed

Not sure which parent commit I need to supply at the -m option. I found some answers on the web about cherry picking commits, but I am afraid that I might perhaps break my pull requests or so... Would be very nice if somebody could get me back on track, so I can create a new pull request!

Thanks!
Bart

[GogoVega]

Hi Bart, use

git reset --soft d27fd37b46a1678fc51a60078adaf96499c29e1b
git push -f

[BartButenaers]

Within 10 seconds after typing my question, I saw this:

What a service
Did we have recently a (very high quality!!!) AI bot installed on Discourse

[BartButenaers]

@GogoVega,
Thanks for the fast answer!!
Mindblowing response time and (as always) a very correct answer.
Really appreciated!!

That solved it.
My brain trusts a soft reset more than a hard reset, so I am going to remember that command

For anybody else having the same issue in the future:

1. Just click on the copy button next to the last "good" commit, i.e. to the point where you want to return:

   

2. Make sure you are on the correct branch locally, in my case git checkout main

3. Reset to that commit using git reset --soft d27fd37b46a1678fc51a60078adaf96499c29e1b

4. Push your changes to the remote (main) branch on Github git push -f

5. Now you can see that the faulty commits are gone:

   

6. So finally my (main) branch was back in sync with the dashboard main branch (from which my branch was forked):

   

[TotallyInformation]

Main branch should always have protections turned on to prevent accidental updates.

[BartButenaers]

@TotallyInformation,
you triggered my attention...
Do you have any more details about that?

[Steve-Mcl]

The source repository does have this enabled. It would make sense if a fork inherited this setting.

@BartButenaers : Managing a branch protection rule - GitHub Docs

[marcus-j-davies]

The one I tend to use @BartButenaers is Require a pull request before merging (as well as others for contributor restrictions)

This forces me to review a PR, before merging into main (even my own commits) - but as the owner, you can bypass - but its asking you to bypass

I have some other repos, that has status checks (like code/security scanning) - before it can be approved

[TotallyInformation]

Yes, that's what I had in mind. As for security checks, I ALWAYS now implement those on any new repo, supply-chain attacks are too common now to ignore this.

[marcus-j-davies]

I have 2 status checks on some other repos of mine.

• CodeQL - We all know that one
• Deep Scan (https://deepscan.io)

[TotallyInformation]

Not forgetting Dependabot to check your dependency chain.

I also have "Socket Security" integrated. This is a GitHub connected cloud service so you go to their web site and connect to your GitHub. It is widely used in security circles.

[marcus-j-davies]

Yup - Dependabot (but gets annoying sometimes) - when the upstream project doesn't stop!
Still - vital!

Check out Deep Scan - its incredibly fast, and has actually highlighted vulnerabilities deep inside the stack, that I hadn't seen my self.

[TotallyInformation]

@marcus-j-davies

Dependabot (but gets annoying sometimes) - when the upstream project doesn't stop!

Agreed. Though you can control it quite well with its comment reply system. I also restricted it a bit more on uibuilder due to the number of dev dependencies.

@marcus-j-davies

Deep Scan

Yes, use that too. Of course, you can't always do anything realistic about deep dependencies.

One thing it has made me do though is to work harder to reduce live dependencies. I will generally not use a dependency any more if I can help it. For example, I used to use dependencies for all sorts of utility processing but I don't do that any more. Copilot really helps there as well since it will generally give me just the utility code I need.

[marcus-j-davies]

I tried Deepscan once, and it highlighted the potential for Javascript Injection, where the user supplied value, was later read out of the database and used Server Side.

The value was berried deep, later in my logic.

Since then started using it, and thought it was awesome!

I won't get to off-topic from here - but then, I'm speaking to a Mod

[BartButenaers]

@Steve-Mcl

The source repository does have this enabled. It would make sense if a fork inherited this setting

That indeed looks better. Thanks!