How to handle an emergency response safely after a GitHub key leak

Accidentally committing a key to GitHub is more urgent than many people think. Deleting the commit or switching to private is only a superficial fix; once a key has entered a remote repository, you must assume it has been leaked. I've seen people just delete the file and re-commit, only to find the old commit is still there, and it may have already been printed in CI logs. My procedure is to…