styleproof 4.4.1 → 4.4.3

package/CHANGELOG.md

@@ -7,6 +7,19 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+### Fixed
+
+- **Map-store uploads now reuse the HTTP authentication persisted by
+  `actions/checkout`.** The isolated `styleproof-maps` clone carries the
+  checkout's URL-scoped extra header through clone and push, so cache-miss
+  captures publish successfully without every consumer wiring a token into the
+  CLI step.
+- **Map-store uploads from Git hooks no longer inherit the caller repository's
+  Git location variables.** A cold `styleproof-maps` upload could otherwise run
+  its temporary `git init` against the consumer repository, set
+  `core.bare=true`, and reject the push after a successful capture. StyleProof
+  now isolates every child Git process from hook-exported repository paths.
+
 ## [4.4.1] - 2026-07-13
 
 ### Changed

package/dist/map-store.js

@@ -16,6 +16,19 @@ export const MAP_MANIFEST = 'styleproof-manifest.json';
  *  has exited — no browser — so it reads the build back from here. Not a surface map. */
 export const BROWSER_BUILD_SIDECAR = 'styleproof-browser.json';
 const GENERATED_DIRTY_ALLOWLIST = new Set(['next-env.d.ts']);
+const GIT_REPOSITORY_ENVIRONMENT_VARIABLES = [
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    'GIT_COMMON_DIR',
+    'GIT_DIR',
+    'GIT_GRAFT_FILE',
+    'GIT_INDEX_FILE',
+    'GIT_INTERNAL_SUPER_PREFIX',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_PREFIX',
+    'GIT_REPLACE_REF_BASE',
+    'GIT_SHALLOW_FILE',
+    'GIT_WORK_TREE',
+];
 /** Bundle files that sit alongside the maps but are NOT surfaces (manifest, coverage
  *  ledger, and any future sidecar). Every place that enumerates surface maps must skip
  *  these, or a sidecar reads as a phantom "new surface". */
@@ -30,8 +43,33 @@ export function isMapFile(name) {
 }
 export class MapStoreError extends Error {
 }
+function gitProcessEnvironment() {
+    const environment = { ...process.env };
+    for (const variableName of GIT_REPOSITORY_ENVIRONMENT_VARIABLES)
+        delete environment[variableName];
+    return environment;
+}
 function runGit(cwd, args, maxBuffer = 1 << 28) {
-    return spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer });
+    return spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer, env: gitProcessEnvironment() });
+}
+function localGitHttpExtraHeaders(cwd) {
+    const configuredHeaders = runGit(cwd, ['config', '--local', '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
+    if (configuredHeaders.status !== 0)
+        return [];
+    return configuredHeaders.stdout
+        .split('\n')
+        .filter(Boolean)
+        .flatMap((configuredHeader) => {
+        const separatorIndex = configuredHeader.indexOf(' ');
+        if (separatorIndex === -1)
+            return [];
+        return [
+            {
+                key: configuredHeader.slice(0, separatorIndex),
+                value: configuredHeader.slice(separatorIndex + 1),
+            },
+        ];
+    });
 }
 function gitOutput(cwd, args) {
     const r = runGit(cwd, args);
@@ -380,11 +418,14 @@ function checkoutMapStore(cwd, remote, branch) {
     if (!remoteExists(remote, cwd))
         throw new MapStoreError(`git remote ${remote} was not found`);
     const remoteUrl = gitOutput(cwd, ['remote', 'get-url', remote]);
+    const httpExtraHeaders = localGitHttpExtraHeaders(cwd);
+    const authenticationArguments = httpExtraHeaders.flatMap(({ key, value }) => ['-c', `${key}=${value}`]);
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'styleproof-map-store-'));
     if (runGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20).status === 0) {
-        const clone = spawnSync('git', ['clone', '-q', '--depth', '1', '--branch', branch, remoteUrl, tmp], {
+        const clone = spawnSync('git', [...authenticationArguments, 'clone', '-q', '--depth', '1', '--branch', branch, remoteUrl, tmp], {
             encoding: 'utf8',
             maxBuffer: 1 << 20,
+            env: gitProcessEnvironment(),
         });
         if (clone.status !== 0) {
             fs.rmSync(tmp, { recursive: true, force: true });
@@ -395,6 +436,8 @@ function checkoutMapStore(cwd, remote, branch) {
         runGit(tmp, ['init', '-q', '-b', branch]);
         runGit(tmp, ['remote', 'add', 'origin', remoteUrl]);
     }
+    for (const { key, value } of httpExtraHeaders)
+        runGit(tmp, ['config', '--local', key, value]);
     return tmp;
 }
 export function publishMapBundle(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.1",
+  "version": "4.4.3",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",