#!/usr/bin/env bash
# Pre-commit hook: block accidental commit of secret files (Added/Copied/Modified only)

BLOCKED=$(git diff --cached --name-only --diff-filter=ACM | grep -E "\.(key|pem|crt)$|^auth\.json$|^\.env$|\.env\.(local|production|staging)$" || true)
if [ -n "$BLOCKED" ]; then
    echo "ERROR: Attempting to commit sensitive files:" >&2
    echo "$BLOCKED" >&2
    echo "Aborting commit. Please unstage sensitive files." >&2
    exit 1
fi
exit 0