I have file abc.properties on my repo which appears under the security report tab because of some sensitive data found on it on some previous version.

When looking at the security tab there is certain commit: "DDD" which still contains the file and change text with the sensitive data showing. This also has the following message at the top: "This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository."

I tried following the recommended steps from using BFG and the tool's page: and arrived to the following script in Windows:

cd "C:\workspace\bfg_cleanup\PATH"
git clone --mirror https://<ON PREMISE ENTERPRISE GITHUB>/USER/REPO
java -jar C:\bfg\bfg-1.14.0.jar --delete-files abc.properties REPO.git
cd "C:\workspace\bfg_cleanup\PATH\REPO.git"
git reflog expire --expire=now --all
git gc --prune=now --aggressive
git push --force

After running my script there are not any warnings or errors shown, but when going back to Github the commit of the file abc.properties is still showing on the history of hash DDD.

Some points to note:

• File abc.properties is deleted from the current branch.
• The GitHub version used is GHES.

Would appreciate any help for this as I am not able to remove that file's commit history and it is still appearing on the security report tab.