#!/usr/bin/env bash
# Run gitleaks against the full git history and staged changes.
# Exits non-zero if any secrets are found.
set -euo pipefail

if ! command -v gitleaks &>/dev/null; then
    echo "gitleaks not found. Install: https://github.com/gitleaks/gitleaks#installing" >&2
    exit 1
fi

REPO_ROOT="$(git rev-parse --show-toplevel)"
cd "$REPO_ROOT"

echo "==> Scanning full git history..."
gitleaks detect --config .gitleaks.toml --no-banner

echo "==> Scanning staged changes..."
gitleaks protect --staged --config .gitleaks.toml --no-banner

echo "Secret scan passed."