While it's absolutely true that if the credentials haven't been pushed then you are not compromised, I would still encourage people to rotate their credentials

While it's absolutely true that if the credentials haven't been pushed then you are not compromised, I would still encourage people to rotate their credentials regardless. All it takes is a mistake when deleting the sensitive information, or having pushed without realizing it to be compromised. Even if you're absolutely positive there wasn't a breach, it can be a good excuse to drill for a _real_ breach later. It never hurts to walk through the practice of what to do if credentials leak when there's no pressure.