I haven't tested this, but I think I'd do force your commits to be published to github (thus re-writing the history again), have your "friend" pull your changes, rebase his changes, then push his changes up. This way, you get both your changes to the same place.
A good rule of thumb is to NEVER FORCE A COMMIT TO GITHUB :) Do it this once to get your repo back to the state it was in before your "friend" messed it up:
# on your machine
git push origin master --force
#now your "friend's" working copy is fairy screwed up, so on his machine:
git checkout -b screwed_up #checks out a new branch called screwed_up
git pull origin master # pulls in your changes
git checkout master #checks out his version with his changes
git rebase screwed_up #moves his changes to the end of your changes (see git graphs for more details)
git commit -am 'your message here'
git push origin master #pushes his changes, which are now merged with your changes back to github