#!/bin/sh
# Red Valley: every commit needs a changelog and must not add obvious secrets.

if git diff --cached --quiet; then
  exit 0
fi

if git diff --cached --quiet -- CHANGELOG.md; then
  echo "Commit blocat: actualizeaza si adauga CHANGELOG.md la fiecare commit." >&2
  exit 1
fi

if git diff --cached --unified=0 -- . ':(exclude)CHANGELOG.md' |
  grep -E '^\+[^+].*(rcon_password|sv_licenseKey|mysql_connection_string|webhook_url|discord_webhook|api[_-]?key|access[_-]?token)([[:space:]]*[:=][[:space:]]*|[[:space:]]+)[^[:space:]"]+' |
  grep -Ev 'GetConvar\(|structure was invalid' >/dev/null; then
  echo "Commit blocat: posibil secret detectat in staged diff." >&2
  exit 1
fi

exit 0