#!/usr/bin/env bash
set -euo pipefail

if command -v gitleaks >/dev/null 2>&1; then
  gitleaks protect --staged --redact
else
  echo "warning: gitleaks not found; skipping staged secret scan" >&2
fi