#!/bin/sh
# Content-based secret gate. See scripts/check_secrets.py for why this exists
# rather than relying on .gitignore alone (2026-07-27 leak).
# Enable once per clone:  git config core.hooksPath .githooks
#
# This file must stay mode 755 in the index: git skips a non-executable hook and
# lets the commit through (older git silently, newer git with one easy-to-miss
# "hint:" line), so at 644 the gate looked armed on macOS/Linux and did nothing
# (Windows git ignores the bit, which is how it shipped that way).
# `python` first keeps Windows unchanged; a stock Mac has only `python3`.
PY=$(command -v python || command -v python3) || {
    echo "pre-commit: no python or python3 on PATH -- secret gate cannot run" >&2
    exit 1
}
"$PY" "$(git rev-parse --show-toplevel)/scripts/check_secrets.py" --staged || exit 1
