#!/usr/bin/env bash
# Blocks commits containing secrets. Installed via:
#   git config core.hooksPath .githooks
# (scripts/codex-setup.sh does this automatically in Codex sessions.)
set -euo pipefail

if command -v gitleaks >/dev/null 2>&1; then
  gitleaks protect --staged -v
else
  nix-shell -p gitleaks --run "gitleaks protect --staged -v"
fi