#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TRUFFLEHOG_IMAGE="ghcr.io/trufflesecurity/trufflehog:3.97.0@sha256:ff4c95e9df7d645daf2140e3ca1039031c63106268d5fbb25feb43ceca1bcc33"
CONTAINER_ID=""

cleanup() {
  if [ -n "$CONTAINER_ID" ]; then
    docker rm -f "$CONTAINER_ID" >/dev/null 2>&1 || true
  fi
}
trap cleanup EXIT

# Gitea/act jobs themselves run inside a container. A normal `docker run -v
# "$ROOT:/repo"` therefore asks the host Docker daemon to mount a path that
# exists only inside the job container. `docker cp` transfers the checked-out
# tree through the Docker API instead and works in both native and nested jobs.
CONTAINER_ID="$(docker create "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --no-update --fail)"
docker cp "$ROOT/." "$CONTAINER_ID:/repo"
docker start -a "$CONTAINER_ID"

echo "Verified-secret scan passed."