Docs: purging unreachable objects in the API reference, Danger zone, git and limits (#97)
#93 documented the purge on the push protection page. The API reference had no description for the endpoint, the repository Danger zone list and the force push section didn't mention it, and the recent sign-in row in Limits didn't list it. Claude-Session: https://claude.ai/code/session_016q5wwBFck8JHq14gHUM2CL Co-authored-by: Claude <noreply@anthropic.com>
Canberk Demirci authored · GitHub committed signed1 parent 90b603acommit 8d60426cffcbe14ff5f07d994bb4fde55795610aBrowse files
4 files changed+9−2
Files (4)
modifiedapps/diffinery/docs/reference/limits.md+1−1View file
| @@ -12,7 +12,7 @@ | ||
| 12 | 12 | | Limit | Value | Applies to | |
| 13 | 13 | | --- | --- | --- | |
| 14 | 14 | | Browser session lifetime | 30 days, extended to 30 days from now on each day the session is used, never past 90 days after sign-in | The session cookie you get after signing in with a passkey, a sign-in link or email recovery. An unused session ends 30 days after its last extension, and every session ends 90 days after its sign-in. | |
| 15 | -| Recent sign-in for sensitive actions | 2 hours | Adding or removing a passkey, creating a token, an agent or an agent token, changing your username, issuing a sign-in link, and deleting or transferring a repository or deleting an organization. An older browser sign-in gets **Confirm it's you** (`403` with a `confirm` URL over the API). See [Confirming it's you](/docs/security/overview#confirming-its-you). | | |
| 15 | +| Recent sign-in for sensitive actions | 2 hours | Adding or removing a passkey, creating a token, an agent or an agent token, changing your username, issuing a sign-in link, deleting, transferring or purging unreachable objects of a repository, and deleting an organization. An older browser sign-in gets **Confirm it's you** (`403` with a `confirm` URL over the API). See [Confirming it's you](/docs/security/overview#confirming-its-you). | | |
| 16 | 16 | | Passkey browser prompt | 2 minutes | Time to complete the browser's passkey dialog when signing in or adding a passkey. | |
| 17 | 17 | | Passkey sign-in attempt | 5 minutes | A sign-in or registration that started more than 5 minutes ago can't be completed; start again. | |
| 18 | 18 | | Sign-in link lifetime | 24 hours, single use | Links a site administrator sends with **Sign-in link** in **Settings → People and invitations**. | |
modifiedapps/diffinery/docs/repositories/git.md+2−0View file
| @@ -257,6 +257,8 @@ | ||
| 257 | 257 | |
| 258 | 258 | The default branch can never be deleted (`cannot delete the default branch`). Change the default branch first under **Settings → General**. |
| 259 | 259 | |
| 260 | +A force push or a deleted branch doesn't delete the commits it leaves behind: anyone who can read the repository can still fetch them by SHA. To remove a pushed secret for good, see [Removing a secret that was pushed](/docs/security/push-protection#removing-a-secret-that-was-pushed). | |
| 261 | + | |
| 260 | 262 | On a branch that matches a [branch protection](/docs/repositories/branch-protection) rule: |
| 261 | 263 | |
| 262 | 264 | | Rule | Push refused with | |
modifiedapps/diffinery/docs/repositories/overview.md+1−1View file
| @@ -150,7 +150,7 @@ | ||
| 150 | 150 | - **Default branch**: a list of the repository's branches (a text field while the repository is empty). The default branch is what the repository page shows, what clones check out, the base for new pull requests, and it is always protected from agents. |
| 151 | 151 | - **Visibility**: **Private** or **Public**. |
| 152 | 152 | |
| 153 | -Below it, the **Danger zone** has **Archive this repository**, **Transfer ownership** (see [Transfer a repository](#transfer-a-repository)) and **Delete this repository**. | |
| 153 | +Below it, the **Danger zone** has **Archive this repository**, **Transfer ownership** (see [Transfer a repository](#transfer-a-repository)), **Purge unreachable objects** (see [Removing a secret that was pushed](/docs/security/push-protection#removing-a-secret-that-was-pushed)) and **Delete this repository**. | |
| 154 | 154 | |
| 155 | 155 | ### Secrets and variables |
| 156 | 156 |
modifiedapps/diffinery/src/docs/api-meta.ts+5−0View file
| @@ -238,6 +238,11 @@ | ||
| 238 | 238 | archived: ["boolean", "Archive (read-only) or unarchive."], |
| 239 | 239 | }, |
| 240 | 240 | }, |
| 241 | + "POST /repos/{owner}/{repo}/diffinery/purge-unreachable": { | |
| 242 | + summary: "Purge unreachable objects", | |
| 243 | + description: "Permanently deletes every commit, tree and file that no branch, tag, pull request, merge queue entry or unfinished workflow run reaches, and empties the archive cache, so a secret force-pushed away can't be fetched by its SHA. Returns `{ objects, bytes }`. People only, not agents. Repositories of up to 300,000 objects (422 otherwise). From a browser session whose sign-in is more than 2 hours old: 403 `Confirm it's you: sign in with your passkey again to do this.` with a `confirm` URL. Audited as `repo.purge_unreachable`. See /docs/security/push-protection#removing-a-secret-that-was-pushed.", | |
| 244 | + access: "admin", | |
| 245 | + }, | |
| 241 | 246 | "DELETE /repos/{owner}/{repo}": { summary: "Delete a repository", description: "People only; agents can't delete repositories. Works on an archived repository too. Audited. From a browser session whose sign-in is more than 2 hours old: 403 `Confirm it's you: sign in with your passkey again to do this.` with a `confirm` URL (see /docs/security/overview#confirming-its-you).", access: "admin", status: 204 }, |
| 242 | 247 | "POST /repos/{owner}/{repo}/transfer": { |
| 243 | 248 | summary: "Transfer a repository", |