#!/usr/bin/env bash
set -euo pipefail

repo_root=$(cd "$(dirname "$0")/.." && pwd -P)
pattern='thtdwh_v1\.[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{43}'

set +e
rg --quiet --hidden --glob '!.git/**' -P -- "$pattern" "$repo_root"
scan_status=$?
set -e

case "$scan_status" in
  0)
    printf '%s\n' 'dwh-auth credential literal scan failed' >&2
    exit 1
    ;;
  1)
    printf '%s\n' 'dwh-auth credential literal scan passed'
    ;;
  *)
    printf '%s\n' "dwh-auth credential literal scan failed (rg status $scan_status)" >&2
    exit "$scan_status"
    ;;
esac