/ scripts / secrets-scan.sh
secrets-scan.sh
 1  #!/usr/bin/env bash
 2  set -euo pipefail
 3  
 4  if command -v gitleaks >/dev/null 2>&1; then
 5    gitleaks_cmd=(gitleaks)
 6  elif command -v mise >/dev/null 2>&1; then
 7    gitleaks_cmd=(mise exec -- gitleaks)
 8  else
 9    echo "gitleaks not found. Run 'mise install' before committing." >&2
10    exit 1
11  fi
12  
13  if "${gitleaks_cmd[@]}" git --help >/dev/null 2>&1; then
14    "${gitleaks_cmd[@]}" git --staged --no-banner --redact
15  elif "${gitleaks_cmd[@]}" protect --help >/dev/null 2>&1; then
16    "${gitleaks_cmd[@]}" protect --staged --no-banner --redact
17  else
18    echo "Unsupported gitleaks CLI. Expected 'git' or 'protect' subcommand." >&2
19    exit 1
20  fi