#!/usr/bin/env bash
set -euo pipefail

repo_root="$(git rev-parse --show-toplevel)"
scanner="$repo_root/scripts/scan-secret-bearing-artifacts.sh"

while read -r local_ref local_sha remote_ref remote_sha; do
  [[ -n "$local_sha" ]] || continue
  if [[ "$local_sha" =~ ^0+$ ]]; then
    continue
  fi

  if [[ "$remote_sha" =~ ^0+$ ]]; then
    "$scanner" --unpublished "$local_sha"
  else
    "$scanner" --git-range "$remote_sha..$local_sha"
  fi
done