#!/bin/sh
# Refuse a commit whose staged changes contain a secret. Enable once per
# checkout with scripts/install-hooks.sh; `git commit --no-verify` skips it.

if ! command -v gitleaks >/dev/null 2>&1; then
    echo "pre-commit: gitleaks is not installed; run 'brew install gitleaks' (or see https://github.com/gitleaks/gitleaks#installing)." >&2
    exit 1
fi

gitleaks git --pre-commit --staged --redact --no-banner --verbose
status=$?
if [ "$status" -ne 0 ]; then
    echo "pre-commit: commit refused, gitleaks found a secret in the staged changes (file, line and rule above)." >&2
    echo "pre-commit: remove it, or, if it is a false positive, allowlist it narrowly in .gitleaks.toml." >&2
fi
exit "$status"
