#!/usr/bin/env bash
# Install git hooks that run the secret scan before every commit.
# Run once after cloning: bash scripts/install-hooks.sh

set -euo pipefail

REPO_ROOT="$(git -C "$(dirname "$0")" rev-parse --show-toplevel)"
HOOK="${REPO_ROOT}/.git/hooks/pre-commit"

cat > "$HOOK" << 'HOOK'
#!/usr/bin/env bash
exec "$(git rev-parse --show-toplevel)/scripts/check-secrets.sh" --staged-only
HOOK

chmod +x "$HOOK"
echo "Installed pre-commit hook → ${HOOK}"
echo "The secret scan will run automatically before every commit."