#!/usr/bin/env bash# Exit non-zero if tracked or staged files contain anything shaped like a credential.# Fails closed: no files to scan, or a pattern that misses a planted sample, is a failure.set -ucd "$(dirname "$0")/.."RE='ed25519:[1-9A-HJ-NP-Za-km-z]{70,}|ghp_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{20,}|-----BEGIN [A-Z ]*PRIVATE KEY|[0-9]{8,12}:AA[A-Za-z0-9_-]{30,}|(api[_-]?key|secret|password|private[_-]?key|seed)["'"'"' ]*[:=]["'"'"' ]*[A-Za-z0-9+/_-]{24,}|CLOUDFLARE_API_TOKEN=[A-Za-z0-9_-]{20,}|swiftbotlabs@gmail'# Positive control: the pattern must catch planted samples (built here, never stored whole).for sample in "ghp_$(printf 'a%.0s' {1..24})" "glpat-$(printf 'b%.0s' {1..24})" "ed25519:$(printf '9%.0s' {1..80})" "-----BEGIN ""PRIVATE KEY"; do  printf '%s\n' "$sample" | grep -q -E "$RE" || { echo "secret scan: pattern misses a planted sample"; exit 1; }donefiles=$(git ls-files --cached --others --exclude-standard | grep -v -E '^(Cargo\.lock|package-lock\.json|web/vendor/|worker/package-lock\.json)' )[ -z "$files" ] && { echo "secret scan: no files to scan"; exit 1; }# Allowed: the scan itself, and the public quote signature in the recorded 1Click fixture# (a signature has the same shape as a key, but it is public by design).hits=$(echo "$files" | tr '\n' '\0' | xargs -0 grep -n -I -E "$RE" 2>/dev/null \  | grep -v -E '^scripts/secret-scan\.sh:' \  | grep -v -E '^test/fixtures/1click-dry-quote\.json:[0-9]+:  "signature": "ed25519:[1-9A-HJ-NP-Za-km-z]+",$')if [ -n "$hits" ]; then  echo "SECRET SCAN HITS:"; echo "$hits" | cut -c1-160; exit 1fiecho "secret scan: 0 hits in $(echo "$files" | wc -l) files, planted samples caught"