Git: support for ref-format=reftable

[acdha]

Description

Git 2.45.0 added support for reftable which has performance improvements on large projects. Unfortunately, Trufflehog does not support this format and if you scan a repository which was initialized with that option or migrated using git refs migrate --ref-format=reftable you will get this error:

$ trufflehog --version
trufflehog 3.95.5
$ trufflehog git --trust-local-git-config --detector-timeout=120s file://.
…
2026-06-04T16:49:24-04:00	error	trufflehog	encountered errors during scan	{"job": 1, "source_name": "trufflehog - git", "errors": ["error chunking dir \".\": core.repositoryformatversion does not support extension: refstorage"]}

Preferred Solution

Trufflehog should support this Git feature.

References

• Should exit with a non-zero code on "error scanning repository" #1879 doesn't cover support but a short-term fix to make errors more visible would be to exit with a non-zero status code when nothing is scanned.

[VatsalGoel3]

Hi, I’d like to investigate this.

I can start by reproducing the failure with a repository initialized or migrated to ref-format=reftable, then trace where TruffleHog’s git source/chunking path rejects core.repositoryformatversion / refstorage.

If full reftable support is too large for a first PR, I can first propose a smaller fix that detects this format and returns a clear actionable error instead of silently failing or producing partial scan behavior.

[VatsalGoel3]

Opened PR #5118 for this: #5118

It implements local reftable repository scanning by detecting extensions.refstorage = reftable and routing that local path through TruffleHog's existing system Git log/diff parser instead of the go-git repository open path that rejects refstorage.

Validation included:

• focused reftable detection and scan tests
• a real git init --ref-format=reftable repo scan with the reported file://. command form
• CGO_ENABLED=0 make test-community
• CGO_ENABLED=0 make lint