#!/bin/sh
set -eu

if ! command -v gitleaks >/dev/null 2>&1; then
  echo "pre-commit: gitleaks is not installed, so staged changes were not scanned." >&2
  echo "pre-commit: install it from your package manager or the gitleaks releases page, then commit again." >&2
  exit 1
fi

if ! gitleaks git --pre-commit --staged --redact --no-banner --verbose .; then
  echo "" >&2
  echo "pre-commit: a possible secret was found in your staged changes. The commit was stopped." >&2
  echo "pre-commit: remove it and keep it in an environment variable instead." >&2
  echo "pre-commit: if it is a false positive, add an allowlist entry to .gitleaks.toml and get it reviewed." >&2
  exit 1
fi
