#!/usr/bin/env python3
"""Small fail-closed scan for high-confidence credential material."""

import argparse
import os
import re
from pathlib import Path


PATTERNS = [
    re.compile(rb"AKIA[0-9A-Z]{16}"),
    re.compile(rb"LTAI[0-9A-Za-z]{12,}"),
    re.compile(rb"BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY"),
]
SKIP_DIRS = {"vendor", "node_modules", "runtime", ".git"}
MAX_FILE_SIZE = 5 * 1024 * 1024


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("root", type=Path)
    args = parser.parse_args()
    findings = []
    for current, dirs, files in os.walk(args.root):
        dirs[:] = [name for name in dirs if name not in SKIP_DIRS]
        for name in files:
            path = Path(current) / name
            try:
                if path.stat().st_size > MAX_FILE_SIZE:
                    continue
                data = path.read_bytes()
            except OSError:
                continue
            if any(pattern.search(data) for pattern in PATTERNS):
                findings.append(str(path.relative_to(args.root)))
    if findings:
        print("SECRET_SCAN_FAIL")
        for finding in findings:
            print(finding)
        return 1
    print("SECRET_SCAN_PASS")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())