styleproof 4.4.12 → 4.4.13

package/CHANGELOG.md

@@ -7,6 +7,15 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.13] - 2026-07-13
+
+### Fixed
+
+- **Workflow-token publication now retries through Git askpass.** When GitHub
+  rejects the temporary checkout's explicit HTTP header, StyleProof clears that
+  header and supplies the token through Git's credential prompt protocol without
+  placing the secret in the remote URL or command arguments.
+
 ## [4.4.12] - 2026-07-13
 
 ### Fixed

package/dist/map-store.js

@@ -484,6 +484,36 @@ function pushMapStoreCommit(cwd, temporaryCheckout, remote, branch, authenticati
     const isolatedPush = runGit(temporaryCheckout, [...authenticationArguments, 'push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
     if (isolatedPush.status === 0)
         return isolatedPush;
+    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
+    if (mapStoreToken) {
+        const askpassDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'styleproof-map-store-askpass-'));
+        const askpassScript = path.join(askpassDirectory, 'askpass.sh');
+        fs.writeFileSync(askpassScript, '#!/bin/sh\ncase "$1" in *Username*) printf "%s\\n" x-access-token ;; *) printf "%s\\n" "$STYLEPROOF_MAP_STORE_TOKEN" ;; esac\n', { mode: 0o700 });
+        try {
+            const askpassPush = spawnSync('git', [
+                '-c',
+                `${['http.https:', '', 'github.com', '.extraheader'].join('/')}=`,
+                'push',
+                '-q',
+                'origin',
+                `HEAD:${branch}`,
+            ], {
+                cwd: temporaryCheckout,
+                encoding: 'utf8',
+                maxBuffer: 1 << 20,
+                env: {
+                    ...gitProcessEnvironment(),
+                    GIT_ASKPASS: askpassScript,
+                    GIT_TERMINAL_PROMPT: '0',
+                },
+            });
+            if (askpassPush.status === 0)
+                return askpassPush;
+        }
+        finally {
+            fs.rmSync(askpassDirectory, { recursive: true, force: true });
+        }
+    }
     const mapStoreCommit = gitOutput(temporaryCheckout, ['rev-parse', 'HEAD']);
     const importCommit = runGit(cwd, ['fetch', '-q', '--no-write-fetch-head', temporaryCheckout, mapStoreCommit], 1 << 20);
     if (importCommit.status !== 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.12",
+  "version": "4.4.13",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",