#!/usr/bin/env bash
# Install git pre-commit hook that runs gitleaks before every commit.
# Idempotent — safe to re-run.
set -euo pipefail

REPO_ROOT="$(git rev-parse --show-toplevel)"
HOOK="${REPO_ROOT}/.git/hooks/pre-commit"

cat > "$HOOK" <<'EOF'
#!/usr/bin/env bash
set -e
if ! command -v gitleaks &>/dev/null; then
    echo "gitleaks not found — skipping pre-commit secret scan"
    echo "Install: https://github.com/gitleaks/gitleaks#installing"
    exit 0
fi
exec gitleaks protect --staged --config .gitleaks.toml --no-banner
EOF

chmod +x "$HOOK"
echo "Pre-commit hook installed at ${HOOK}"