#!/usr/bin/env python3
"""Exit nonzero when publication candidates contain credential-shaped text."""

from __future__ import annotations

import argparse
import json
from dataclasses import asdict
from pathlib import Path

from br_sovereign_llm.publication.secret_scan import (
    SecretScanError,
    scan_release_directory,
    scan_repository,
)


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("root", nargs="?", default=Path.cwd(), type=Path)
    parser.add_argument(
        "--release",
        action="store_true",
        help="scan every file under an exact release root without exclusions",
    )
    arguments = parser.parse_args()
    try:
        findings = (
            scan_release_directory(arguments.root)
            if arguments.release
            else scan_repository(arguments.root)
        )
    except SecretScanError as error:
        print(
            json.dumps(
                {"ok": False, "finding_count": None, "error": str(error)},
                indent=2,
                sort_keys=True,
            )
        )
        return 2
    print(
        json.dumps(
            {
                "ok": not findings,
                "finding_count": len(findings),
                "findings": [asdict(finding) for finding in findings],
            },
            indent=2,
            sort_keys=True,
        )
    )
    return 0 if not findings else 1


if __name__ == "__main__":
    raise SystemExit(main())