#!/usr/bin/env bash
# Guards every commit against leaked secrets.
#
# It lives HERE on purpose: `technitium-console` is its own repository with its
# own remote, so pointing `core.hooksPath` at a hooks folder outside it would
# leave the guard broken as soon as someone cloned this repository on its own.
#
# Per machine:  git config core.hooksPath .githooks
set -euo pipefail
if ! command -v gitleaks >/dev/null 2>&1; then
  echo "pre-commit: gitleaks is not installed. Commit aborted for safety" >&2
  exit 1
fi
# gitleaks v8.19+: `protect` was replaced by `git --staged` (pre-commit mode).
gitleaks git --staged --redact -v