Fix git scan repository field using local file path instead of upstre…

[jamesgol]

Description:

Fixes the git scan repository metadata field containing a local file:// path instead of the actual upstream remote URL when scanning pre-cloned local repositories.

Problem: When running trufflehog git file:///path/to/local/clone, TruffleHog re-clones the repo to a temp directory. The clone's origin remote gets set to the file:// path, and GetSafeRemoteURL returns that local path as the Repository in JSON output — even when the original repo has a real remote (e.g. https://dev.azure.com/org/project/_git/repo).

Fix: Updated GetSafeRemoteURL in pkg/sources/git/git.go to detect when the resolved remote URL is a local path (file:// scheme or absolute filesystem path). When detected, it opens the original repository and resolves its upstream remote URL instead. This is bounded to a single level of indirection — if the resolved URL is also local, it falls back to the original behavior.

Added two helper functions:

• localRepoPath — identifies whether a URL refers to a local repo
• resolveUpstreamRemote — opens the local repo and returns its non-local remote URL

Tests: Added 7 test cases covering:

• Local clone resolves to upstream remote
• file:// clone resolves to upstream remote
• Bare clone resolves to upstream remote
• Repo with no remotes returns empty string
• Local clone of repo with no upstream falls back to local path
• Repo with a real remote returns it directly (no resolution needed)
• Fallback to first available remote when preferred doesn't exist

Closes #4876

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Changes how GetSafeRemoteURL resolves repository URLs, including opening local repositories and potentially altering reported metadata for file/absolute-path remotes; edge cases in path/URL handling could affect output correctness.

Overview
Fixes git scan Repository metadata when scanning pre-cloned local repos by resolving file:///absolute-path remotes to their upstream non-local remote instead of reporting the local path.

GetSafeRemoteURL now detects local remotes, opens the referenced repo, and returns its remote URL (bounded to one hop to avoid recursive local-path chains). Adds focused tests covering local clones, file:// clones, bare clones, missing remotes, and fallback remote selection.

^{Reviewed by Cursor Bugbot for commit 5253358. Bugbot is set up for automated code reviews on this repo. Configure here.}