#!/usr/bin/env bash
set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
NC='\033[0m'

TARGET="${1:-.}"

echo "=== Secrets Scan ==="

if ! command -v gitleaks &>/dev/null; then
  printf "${RED}✗${NC} gitleaks not installed\n"
  exit 2
fi

if gitleaks detect --source "$TARGET" -v --no-git 2>/dev/null; then
  printf "${GREEN}✓${NC} No secrets detected\n"
  exit 0
else
  printf "${RED}✗${NC} Secrets found — fix before proceeding\n"
  exit 1
fi