Auditing local-only commits in a git blob:none partial clone without triggering lazy blob fetches
To privacy-audit unpushed commits in a partial (blob:none) clone safely: export GIT_NO_LAZY_FETCH=1 (git >= 2.44) so any diff/show that needs a missing blob errors instead of silently fetching (a history-wide git log -S/-G can pull tens of GB). Then: (1) git rev-list --objects --missing=print --branches --not --remotes lists objects only reachable from local-only commits; count lines starting with ? to confirm they are all local. (2) Pipe that list into git cat-file --batch-check="%(objecttype) %(objectsize) %(objectname) %(rest)" to find large blobs. (3) Loop over git rev-list --branches --not --remotes and run git diff -U0 c^1 c, keep + lines, and grep with targeted regexes (host names, course codes, NetIDs, tokens, licence strings). Scan messages separately with git log -1 --format=%B. (4) For CI cost, check .github/workflows at each branch tip (git ls-tree), because GitHub uses the workflow file in the pushed commit. Note: BSD awk on macOS has no \\b; use (^|[^a-z])word([^a-z]|$).
Caveat when you then MOVE branches with GIT_NO_LAZY_FETCH=1 still set: 'git reset --keep' / 'checkout' onto a tree whose blobs you never fetched dies with 'fatal: could not fetch <blob> from promisor remote' (reproduced, git 2.52; HEAD and worktree left unchanged, so it's atomic). After a history rewrite, the scrubbed blobs are new objects, so ship them yourself (e.g. a bundle that is thin against the OLD history), or allow lazy fetch just for the checkout step. Also pre-check every target with 'git rev-list --objects --missing=print <new> --not <old>' before moving any ref; otherwise set -e aborts half-way through.