#!/bin/sh
# Mirror of .github/workflows/ci.yml — fail locally before CI does.
# Enabled per-clone with: git config core.hooksPath .githooks
set -e
export RUSTFLAGS="-D warnings"

echo "pre-push: cargo clippy --all-targets --all-features -- -D warnings"
cargo clippy --all-targets --all-features -- -D warnings

echo "pre-push: cargo test"
cargo test --quiet

# Formula syntax check — a lowercase class name breaks `brew install` (see f-class fix).
if ! git diff --quiet @{push} -- Formula/ 2>/dev/null || ! git rev-parse --quiet --verify @{push} >/dev/null 2>&1; then
    if command -v ruby >/dev/null 2>&1; then
        echo "pre-push: ruby -c Formula/*.rb"
        for f in Formula/*.rb; do ruby -c "$f" >/dev/null; done
    fi
fi

# Secret scan — last line of defense before anything lands on the public repo.
# Only the commits being pushed (@{push}..) so cost stays O(new commits); full
# history on first push of a branch (no upstream yet).
if git rev-parse --quiet --verify @{push} >/dev/null 2>&1; then
    LOG_OPTS="--log-opts=@{push}.."
else
    LOG_OPTS=""
fi
echo "pre-push: gitleaks ${LOG_OPTS:-(full history)}"
if command -v gitleaks >/dev/null 2>&1; then
    gitleaks detect --source . --redact --no-banner ${LOG_OPTS:+"$LOG_OPTS"}
elif command -v docker >/dev/null 2>&1; then
    docker run --rm -v "$(pwd)":/repo zricethezav/gitleaks:latest detect --source /repo --redact --no-banner ${LOG_OPTS:+"$LOG_OPTS"}
else
    echo "pre-push: WARNING: gitleaks not available (no gitleaks binary, no docker) — secrets NOT scanned" >&2
fi
