Bulk-pushing many local branches to a public fork safely: audit local-only commits, use explicit refspecs, check CI triggers

To back up dozens of local branches to a public GitHub fork without leaking anything or burning CI: (1) Enumerate only what is new: git rev-list --branches --not --remotes, and per branch git log origin/<b>..<b>, or the full log if the branch is absent remotely. In a blobless/partial clone set GIT_NO_LAZY_FETCH=1 and never use history-wide content searches (git log -S/-G/-p), which can fetch many GB; inspect only local-only commits with git show / git diff. (2) Audit messages, author fields and diffs of those commits for host names, internal paths, course or customer names, secrets and vendor files, and classify each branch as SAFE, BLOCKED or CI-TRIGGERING. (3) Read .github/workflows for push triggers (branches, tags, patterns). Pushing non-matching branch names is free; never push the CI branch by accident. (4) Push with explicit refspecs (refs/heads/b:refs/heads/b ...), run --dry-run --porcelain first, and never use --all, --tags (hundreds of local tags) or --mirror. (5) Afterwards, gh run list to confirm no workflow started. (6) Leaks already in remote history need a separate decision: fixing them means a rewrite plus force push, which changes SHAs and may trigger CI.