styleproof 4.4.10 → 4.4.11

package/CHANGELOG.md

@@ -7,6 +7,15 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.11] - 2026-07-13
+
+### Fixed
+
+- **Map-store pushes now receive workflow authentication directly.** The final
+  `git push` uses the same explicit reset-and-token arguments as the isolated
+  clone, so temporary sparse-checkout config cannot drop the Actions token after
+  a successful cold-cache capture.
+
 ## [4.4.10] - 2026-07-13
 
 ### Fixed

package/dist/map-store.js

@@ -495,6 +495,10 @@ export function publishMapBundle(options) {
     const sha = safeSegment(manifest.sha, 'sha');
     const compatibilityKey = safeSegment(manifest.compatibilityKey, 'compatibility key');
     const target = `${sha}/${compatibilityKey}`;
+    const pushAuthenticationArguments = effectiveGitHttpExtraHeaders(cwd).flatMap(({ key, value }) => [
+        '-c',
+        `${key}=${value}`,
+    ]);
     let ok = false;
     let lastError = '';
     for (let attempt = 1; attempt <= 5; attempt++) {
@@ -510,7 +514,7 @@ export function publishMapBundle(options) {
             }
             runGit(tmp, ['add', '-A', '--sparse', '--', 'README.md', target]);
             runGit(tmp, ['commit', '-q', '-m', `StyleProof map ${sha.slice(0, 12)} ${compatibilityKey}`], 1 << 20);
-            const push = runGit(tmp, ['push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
+            const push = runGit(tmp, [...pushAuthenticationArguments, 'push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
             if (push.status === 0) {
                 ok = true;
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.10",
+  "version": "4.4.11",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",