styleproof 4.4.11 → 4.4.13

package/CHANGELOG.md

@@ -7,6 +7,24 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.13] - 2026-07-13
+
+### Fixed
+
+- **Workflow-token publication now retries through Git askpass.** When GitHub
+  rejects the temporary checkout's explicit HTTP header, StyleProof clears that
+  header and supplies the token through Git's credential prompt protocol without
+  placing the secret in the remote URL or command arguments.
+
+## [4.4.12] - 2026-07-13
+
+### Fixed
+
+- **Map-store publication now survives an isolated push losing Actions
+  authentication.** If the sparse temporary checkout is rejected, StyleProof
+  imports its generated commit into the original checkout and retries the push
+  through checkout-v7's authenticated Git context.
+
 ## [4.4.11] - 2026-07-13
 
 ### Fixed

package/dist/map-store.js

@@ -480,6 +480,46 @@ function checkoutMapStore(cwd, remote, branch, sparseSegment) {
         checkoutSparseSegment(tmp, branch, sparseSegment);
     return tmp;
 }
+function pushMapStoreCommit(cwd, temporaryCheckout, remote, branch, authenticationArguments) {
+    const isolatedPush = runGit(temporaryCheckout, [...authenticationArguments, 'push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
+    if (isolatedPush.status === 0)
+        return isolatedPush;
+    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
+    if (mapStoreToken) {
+        const askpassDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'styleproof-map-store-askpass-'));
+        const askpassScript = path.join(askpassDirectory, 'askpass.sh');
+        fs.writeFileSync(askpassScript, '#!/bin/sh\ncase "$1" in *Username*) printf "%s\\n" x-access-token ;; *) printf "%s\\n" "$STYLEPROOF_MAP_STORE_TOKEN" ;; esac\n', { mode: 0o700 });
+        try {
+            const askpassPush = spawnSync('git', [
+                '-c',
+                `${['http.https:', '', 'github.com', '.extraheader'].join('/')}=`,
+                'push',
+                '-q',
+                'origin',
+                `HEAD:${branch}`,
+            ], {
+                cwd: temporaryCheckout,
+                encoding: 'utf8',
+                maxBuffer: 1 << 20,
+                env: {
+                    ...gitProcessEnvironment(),
+                    GIT_ASKPASS: askpassScript,
+                    GIT_TERMINAL_PROMPT: '0',
+                },
+            });
+            if (askpassPush.status === 0)
+                return askpassPush;
+        }
+        finally {
+            fs.rmSync(askpassDirectory, { recursive: true, force: true });
+        }
+    }
+    const mapStoreCommit = gitOutput(temporaryCheckout, ['rev-parse', 'HEAD']);
+    const importCommit = runGit(cwd, ['fetch', '-q', '--no-write-fetch-head', temporaryCheckout, mapStoreCommit], 1 << 20);
+    if (importCommit.status !== 0)
+        return isolatedPush;
+    return runGit(cwd, ['push', '-q', remote, `${mapStoreCommit}:${branch}`], 1 << 20);
+}
 export function publishMapBundle(options) {
     const cwd = options.cwd ?? process.cwd();
     const branch = options.branch ?? DEFAULT_MAP_STORE_BRANCH;
@@ -514,7 +554,7 @@ export function publishMapBundle(options) {
             }
             runGit(tmp, ['add', '-A', '--sparse', '--', 'README.md', target]);
             runGit(tmp, ['commit', '-q', '-m', `StyleProof map ${sha.slice(0, 12)} ${compatibilityKey}`], 1 << 20);
-            const push = runGit(tmp, [...pushAuthenticationArguments, 'push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
+            const push = pushMapStoreCommit(cwd, tmp, remote, branch, pushAuthenticationArguments);
             if (push.status === 0) {
                 ok = true;
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.11",
+  "version": "4.4.13",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",