#!/usr/bin/env bash
# Git repository secrets scanner using gitleaks.
# Usage: bash scripts/scan_secrets.sh [--path /path/to/repo] [--format json]
set -euo pipefail

REPO_PATH="${1:-.}"
FORMAT="${2:-json}"

if ! command -v gitleaks &>/dev/null; then
  echo "ERROR: gitleaks not found. Install: brew install gitleaks OR go install github.com/gitleaks/gitleaks/v8/cmd/gitleaks@latest"
  exit 1
fi

echo "Scanning $REPO_PATH for secrets..." >&2
gitleaks detect --source "$REPO_PATH" --report-format "$FORMAT" --report-path /dev/stdout --verbose 2>/dev/null
EXIT=$?

if [ $EXIT -eq 0 ]; then
  echo "✅ No secrets found" >&2
else
  echo "🔴 Secrets detected! Review output above" >&2
fi
exit $EXIT
