Web UI shows deleted commits and contents.

Summary

Deleted commits still show in user profiles, including the diffs/contents of the commit.

Steps to reproduce

  1. Create the repo
  2. Add a new file with secrets
  3. Commit
  4. Push
  5. Contemplate life choices
  6. Delete the file
  7. Amend the commit
  8. Use the Force (push)
  9. Hope nobody saw your secret (wait 30 mins, as per: #212763 (comment 1099170698))
  10. Realize that your profile page still has a direct link to the "deleted" commit (profile: https://gitlab.com/SheepReaper, commit: SheepReaper/secret-whoops@671d37ce)

Example Project

Here is the minimal repro repo: https://gitlab.com/SheepReaper/secret-whoops

What is the current bug behavior?

Deleted commits can still be seen on web UI.

What is the expected correct behavior?

Deleted commits should be removed entirely as these are often deleted to remove sensitive information that was accidentally pushed.

Relevant logs and/or screenshots

Git log Git log

Profile history Profile history

Deleted commit contents Deleted commit contents

Output of checks

This bug happens on GitLab.com

GitLab Enterprise Edition 11.1.0-ee 9a9f41d

Possible fixes

(If you can, link to the line of code that might be responsible for the problem)

Edited by Sean Carroll