#!/bin/bash

# Check for potential secrets in code
echo "Checking for potential hardcoded secrets..."

# This will only show warnings but won't fail the build
if grep -r --exclude-dir=.venv --exclude-dir=__pycache__ --exclude-dir=.git \
  --include="*.py" --include="*.yaml" --include="*.yml" --include="*.toml" \
  -iE '(password|secret|key|token|credential)[[:space:]=:"\x27]+[a-zA-Z0-9]{16,}(?<!DefaultAzureCredential\()' .; then
  echo "::warning::Potential hardcoded secret found. Please review the above matches carefully."
  exit 0
else
  echo "No obvious hardcoded secrets found."
  exit 0
fi