Yesterday, I pushed to my fork of ConnectBot on GitHub. I pushed once, realized that I hadn't made the change the way I wanted, redid the commit and pushed again.
Now, GitHub has both commits:
My master branch is only tracking the second commit, but the first commit is still available and is still in my activity feed. How can I remove it to make sure no one accidentally pulls that commit instead of the corrected version?
Delete the repo or contact GitHub
Deleting the repo and recreating it without the bad commit seems to work if you can afford losing all issues. The data also disappears from the commit API (although push events are still visible). See also: https://stackoverflow.com/a/32840254/895245
If you can't afford to lose issue data, GitHub support can manually delete dangling commits. For example, when I uploaded all GitHub commit emails to a repo they asked me to take it down, so I did, and they did a gc. Pull requests that contain the data have to be deleted however: that repo data remained accessible up to one year after initial takedown due to this.
Their current help page says:
you can permanently remove all of your repository's cached views and pull requests on GitHub by contacting GitHub Support.
Maybe making the repo private will also keep the issues around and get rid of the commit, I'm not sure. You lose stars/forks for sure though. Not sure if after restore the commits will be gone or not. But at least you might be able to keep a private backup of issues.