#!/usr/bin/env bash
# Scan for secrets. Known values are listed in the redacted baseline.
# Usage: scripts/check-secrets.sh [--staged]
set -euo pipefail

cd "$(dirname "${BASH_SOURCE[0]}")/.."

version="8.30.1"
bin="$PWD/.scratch/bin/gitleaks"

if ! command -v gitleaks >/dev/null 2>&1; then
  if [ ! -x "$bin" ]; then
    case "$(uname -m)" in
      x86_64|amd64) arch=x64 ;;
      aarch64|arm64) arch=arm64 ;;
      *)
        echo "unsupported architecture: $(uname -m)" >&2
        exit 1
        ;;
    esac
    echo "installing gitleaks $version into .scratch/bin" >&2
    mkdir -p .scratch/bin
    curl -fsSL -o .scratch/bin/gitleaks.tar.gz \
      "https://github.com/gitleaks/gitleaks/releases/download/v${version}/gitleaks_${version}_linux_${arch}.tar.gz"
    tar -xzf .scratch/bin/gitleaks.tar.gz -C .scratch/bin gitleaks
  fi
  PATH="$PWD/.scratch/bin:$PATH"
fi

if [ "${1:-}" = "--staged" ]; then
  gitleaks git --pre-commit --staged --redact --verbose \
    --baseline-path .gitleaks-baseline.json
else
  gitleaks git --baseline-path .gitleaks-baseline.json --redact --no-banner
fi