Pre-commit hook to check for ansible encryption

pre-commit

#!/bin/bash

VAULT_DIR="secrets"
EXIT_CODE=0

for file in $(git diff --cached --name-only | grep "^$VAULT_DIR/"); do
  if [ ! -f "$file" ]; then
    echo "Warning: $file does not exist. Skipping."
    continue
  fi

  if ! grep -q "\$ANSIBLE_VAULT;" "$file"; then
    echo "Error: $file is not encrypted. Please encrypt the file before committing."
    echo "1. Remove the unencrypted secrets from the Git history:"
    echo "   git reset HEAD"
    echo ""
    echo "2. Encrypt the file(s) using Ansible Vault:"
    echo "   ansible-vault encrypt <file> --vault-password-file <VAULT_PASS_SCRIPT>"
    echo "   git add <file>"
    echo "   git commit -m 'Encrypt secrets'"
    EXIT_CODE=1
  fi
done

exit $EXIT_CODE