# Fail if tracked text still contains production-only markers (run before GitHub push).
$ErrorActionPreference = 'Stop'
$Root = Split-Path -Parent $PSScriptRoot
Set-Location $Root

$patterns = @(
    '8239219522',
    'sac_UkOsAT',
    '2843230',
    'sac\.kalinamall\.ru',
    '\\\\b26\\',
    'K6A-DC3',
    'fifth\.kalinamall',
    '192\.168\.160\.57',
    'kalinamall\.ru',
    'git\.kalinamall\.ru',
    'git\.papatramp\.ru',
    '\d{8,12}:[A-Za-z0-9_-]{20,}'
)

$extensions = @('*.md', '*.ps1', '*.example', '*.txt', '*.json', '*.yml', '*.yaml')
$files = git ls-files $extensions 2>$null | Where-Object { $_ -and (Test-Path $_) }

$hits = @()
foreach ($file in $files) {
    if ($file -like 'scripts/Rewrite-GitHostUrls.ps1') { continue }
    if ($file -like 'scripts/Push-PrivateMirror.ps1') { continue }
    if ($file -like 'scripts/Sanitize-ForGitHub.ps1') { continue }
    if ($file -like 'scripts/Test-NoSecretsForGitHub.ps1') { continue }
    if ($file -like 'scripts/Push-GitHubMirror.ps1') { continue }

    $text = Get-Content -LiteralPath $file -Raw -ErrorAction SilentlyContinue
    if ([string]::IsNullOrEmpty($text)) { continue }

    foreach ($pat in $patterns) {
        if ($text -match $pat) {
            $hits += "${file}: matches /$pat/"
        }
    }
}

if ($hits.Count -gt 0) {
    Write-Error ("GitHub secret scan failed:`n" + ($hits -join "`n"))
}

Write-Output "GitHub secret scan: OK ($($files.Count) files)"