"""Scan tracked content without printing matched credentials."""
from pathlib import Path
import re
import subprocess

RULES = {
    "telegram-token": re.compile(r"\b\d{6,12}:[A-Za-z0-9_-]{32,}\b"),
    "private-key": re.compile(r"-----BEGIN (?:OPENSSH |RSA |EC )?PRIVATE KEY-----"),
}


def main():
    files = subprocess.check_output(["git", "ls-files", "-z"]).decode("utf-8").split("\0")
    violations = []
    for name in filter(None, files):
        path = Path(name)
        if not path.is_file():
            continue
        if path.name.startswith(".env") and not path.name.endswith(".example"):
            violations.append(f"{name}: tracked runtime environment")
        if ".history" in path.parts:
            violations.append(f"{name}: tracked editor history")
        text = path.read_text(encoding="utf-8", errors="replace")
        for rule, pattern in RULES.items():
            for match in pattern.finditer(text):
                line = text.count("\n", 0, match.start()) + 1
                violations.append(f"{name}:{line}: {rule}")
    for violation in violations:
        print(violation)
    if violations:
        raise SystemExit(1)
    print("Tracked secret scan passed")


if __name__ == "__main__":
    main()