fix(darwin): appearance self-heal sweep + idempotent wallpaper hook —… #1190

	# Secrets scanning — the required check that gates merge on a secret leak
	# (added to the main ruleset; see docs/ci.md §"Display name and branch
	# protection"). Runs on every PR and on push to main. Default scope is
	# incremental (gitleaks-action diffs against the merge base for PRs and
	# the push range for pushes), which needs the full history. Push is scoped
	# to main so a PR branch isn't double-scanned (push + pull_request both
	# firing).
	#
	# No GITLEAKS_LICENSE env var is required for personal-account repos;
	# the license is only required for organization repos per the
	# gitleaks-action README.
	name: gitleaks

	on:
	push:
	branches: [main]
	pull_request:

	jobs:
	scan:
	# Explicit name → the required-status-check context is `gitleaks`, not
	# the bare job id. Keep it stable; the ruleset matches on this name.
	name: gitleaks
	runs-on: ubuntu-24.04
	# Incremental scans run in seconds; this is a hang backstop, not a
	# budget. See docs/ci.md §Timeouts.
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
	with:
	fetch-depth: 0

	# Pinned at v3, which migrates the action runtime from Node 20 to
	# Node 24 (no input/output/behaviour change vs v2); this clears the
	# GitHub Node-20-deprecation warning that v2 raised. Tag bumps do
	# not auto-flow under SHA pinning (ADR-025), so an upstream tag move
	# is the operator's signal to repin here intentionally.
	- uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback