#!/usr/bin/env bash
# Labels sensitive files in the diff against a base branch and fails when any need a designated reviewer.
# Usage: scripts/verify-release-gates [base-ref]   (default: origin/main)
set -euo pipefail
cd "$(dirname "$0")/.."

BASE="${1:-origin/main}"
echo "== Sensitive files changed since ${BASE}"
set +e
git diff --name-only "${BASE}...HEAD" | swift run --quiet trailhead-gate
STATUS=$?
set -e

if [ "${STATUS}" -eq 2 ]; then
  echo "Sensitive files changed. A designated reviewer must approve before merge." >&2
  exit 2
fi
exit "${STATUS}"
