#!/usr/bin/env bash
# Install the repo commit gate into this clone (idempotent, re-runnable):
#   1. bootstrap gitleaks binary if missing  → ~/.local/bin/gitleaks (pinned)
#   2. copy scripts/gate/hooks/*  → .git/hooks/*   (repo-local, NOT in repo)
# 3-9 show what the gate will do on every commit/push.
# Nothing here is in the committed history; hooks live in .git/hooks/.
set -eu
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
[ -f "$ROOT/scripts/install/install-hooks.sh" ] || { echo "install: cannot find repo root from $(dirname "$0")" >&2; exit 1; }
cd "$ROOT"

echo "== 1/3 gitleaks"
if ! command -v gitleaks >/dev/null 2>&1; then
  if [ -x "$HOME/.local/bin/gitleaks" ]; then
    echo "[install] gitleaks at ~/.local/bin (not on PATH) — will be used via absolute path"
  else
    bash scripts/install/bootstrap-gitleaks.sh
  fi
else
  gitleaks version | sed 's/^/[install] gitleaks /'
fi

echo "== 2/3 hooks"
install -m0755 scripts/gate/hooks/pre-commit .git/hooks/pre-commit
install -m0755 scripts/gate/hooks/pre-push   .git/hooks/pre-push
echo "[install] wrote .git/hooks/pre-commit, .git/hooks/pre-push"

echo "== 3/3 ready"
echo "[install] commits gated: secret → tsc → tests   (fast, seconds)"
echo "[install] pushes  gated: secret(history) → full next build → tests"
echo "[install] bypass (auditable at the pusher's shell): git commit/push --no-verify"
echo "[install] NOTE: gate lives in THIS clone's .git/hooks — after git clone,"
echo "[install] the same-branch pull on another machine re-installs by re-running:"
echo "[install]   bash scripts/install/install-hooks.sh"