#!/bin/bash
set -euo pipefail

REPO_ROOT=$(git rev-parse --show-toplevel)
cd "$REPO_ROOT"

echo "🔒 Running pre-push security checks..."

if ! command -v trufflehog >/dev/null 2>&1; then
  echo "⚠ trufflehog not found. Install it to enable secret scanning (skipping)." >&2
else
  echo "Running TruffleHog secret scan..."
  trufflehog filesystem --only-verified --exclude-paths .trufflehog_exclude.txt --fail .
fi

if ! command -v cargo >/dev/null 2>&1; then
  echo "⚠ cargo not found. Skipping cargo audit." >&2
else
  if ! command -v cargo-audit >/dev/null 2>&1; then
    echo "⚠ cargo-audit not found. Install with: cargo install cargo-audit --locked (skipping)." >&2
  else
    echo "Running cargo audit..."
    cargo audit --deny warnings
  fi
fi

if ! command -v cargo-deny >/dev/null 2>&1; then
  echo "⚠ cargo-deny not found. Install with: cargo install cargo-deny --locked (skipping)." >&2
else
  echo "Running cargo deny..."
  cargo deny check --all-features
fi

echo "✅ Pre-push security checks completed."
