#!/bin/bash
# .githooks/pre-commit — gitleaks pre-commit gate (P03, REQ-039).
#
# Runs `gitleaks protect --staged` on every commit. If gitleaks is
# not installed, the hook is a no-op (the commit proceeds). CI
# catches the same findings via `.coreci.yml` `validate` pipeline.
#
# Install: `git config core.hooksPath .githooks`

set -e

if ! command -v gitleaks >/dev/null 2>&1; then
  echo "  (gitleaks not installed; skipping pre-commit secret scan; CI will catch it)"
  exit 0
fi

# Find the repo root (this hook lives in .githooks/).
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$REPO_ROOT"

# Run gitleaks on staged content. The --baseline-path suppresses
# pre-existing findings (REQ-029 — the v0.1 .env leak).
gitleaks protect --staged --config .gitleaks.toml --baseline-path .gitleaks-baseline.json