#!/usr/bin/env bash
#
# Credentials in the tracked tree.
#
# `scripts/secrets.sh` runs on the staged diff from the pre-commit hook, which
# is the cheap moment. This is the whole-tree version, run as part of verify so
# that something looks at what is ALREADY committed rather than only at what is
# arriving.
#
# The distinction earned itself here: the Zoho WebToLead tokens sat in four
# commits of a then-public repository for a month, and a staged-diff scan
# installed afterwards would never have mentioned them.
#
# Exit 0 clean, 1 findings, 2 the scanner could not run.
set -uo pipefail
cd "$(git rev-parse --show-toplevel)" || exit 1

[ -f scripts/secrets.sh ] || { echo "secrets: scripts/secrets.sh is missing — nothing was scanned." >&2; exit 2; }
bash scripts/secrets.sh --tracked