styleproof 4.4.12 → 4.4.14

package/CHANGELOG.md

@@ -7,6 +7,23 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.14] - 2026-07-13
+
+### Fixed
+
+- **Workflow-token publication now uses Git's credential protocol for the final retry.**
+  The token stays out of remote URLs and process arguments, while real Git credential
+  lookup is covered directly instead of relying on an executable askpass script.
+
+## [4.4.13] - 2026-07-13
+
+### Fixed
+
+- **Workflow-token publication now retries through Git askpass.** When GitHub
+  rejects the temporary checkout's explicit HTTP header, StyleProof clears that
+  header and supplies the token through Git's credential prompt protocol without
+  placing the secret in the remote URL or command arguments.
+
 ## [4.4.12] - 2026-07-13
 
 ### Fixed

package/dist/map-store.d.ts

@@ -47,6 +47,7 @@ export interface CachedCaptureDirs {
     compatibilityKey: string;
     tmpRoot: string;
 }
+export declare function workflowTokenCredentialArguments(): string[];
 /** Record the real browser build into the capture dir. Called from a capture run, where a
  *  Playwright browser handle is in scope. Write-or-CLEAR semantics: an undefined version
  *  REMOVES any existing sidecar rather than leaving it, so a reused capture dir (e.g. the

package/dist/map-store.js

@@ -52,6 +52,10 @@ function gitProcessEnvironment() {
 function runGit(cwd, args, maxBuffer = 1 << 28) {
     return spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer, env: gitProcessEnvironment() });
 }
+const WORKFLOW_TOKEN_CREDENTIAL_HELPER = '!f() { if [ "$1" = get ]; then printf \'%s\\n\' username=x-access-token "password=$STYLEPROOF_MAP_STORE_TOKEN"; fi; }; f';
+export function workflowTokenCredentialArguments() {
+    return ['-c', 'credential.helper=', '-c', `credential.helper=${WORKFLOW_TOKEN_CREDENTIAL_HELPER}`];
+}
 function parseGitHttpExtraHeaders(configuredHeaders) {
     return configuredHeaders
         .split('\n')
@@ -484,6 +488,30 @@ function pushMapStoreCommit(cwd, temporaryCheckout, remote, branch, authenticati
     const isolatedPush = runGit(temporaryCheckout, [...authenticationArguments, 'push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
     if (isolatedPush.status === 0)
         return isolatedPush;
+    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
+    if (mapStoreToken) {
+        const githubExtraHeaderKey = ['http.https:', '', 'github.com', '.extraheader'].join('/');
+        runGit(temporaryCheckout, ['config', '--local', '--unset-all', githubExtraHeaderKey], 1 << 20);
+        const credentialPush = spawnSync('git', [
+            '-c',
+            `${githubExtraHeaderKey}=`,
+            ...workflowTokenCredentialArguments(),
+            'push',
+            '-q',
+            'origin',
+            `HEAD:${branch}`,
+        ], {
+            cwd: temporaryCheckout,
+            encoding: 'utf8',
+            maxBuffer: 1 << 20,
+            env: {
+                ...gitProcessEnvironment(),
+                GIT_TERMINAL_PROMPT: '0',
+            },
+        });
+        if (credentialPush.status === 0)
+            return credentialPush;
+    }
     const mapStoreCommit = gitOutput(temporaryCheckout, ['rev-parse', 'HEAD']);
     const importCommit = runGit(cwd, ['fetch', '-q', '--no-write-fetch-head', temporaryCheckout, mapStoreCommit], 1 << 20);
     if (importCommit.status !== 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.12",
+  "version": "4.4.14",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",