styleproof 4.4.13 → 4.4.14

package/CHANGELOG.md

@@ -7,6 +7,14 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.14] - 2026-07-13
+
+### Fixed
+
+- **Workflow-token publication now uses Git's credential protocol for the final retry.**
+  The token stays out of remote URLs and process arguments, while real Git credential
+  lookup is covered directly instead of relying on an executable askpass script.
+
 ## [4.4.13] - 2026-07-13
 
 ### Fixed

package/dist/map-store.d.ts

@@ -47,6 +47,7 @@ export interface CachedCaptureDirs {
     compatibilityKey: string;
     tmpRoot: string;
 }
+export declare function workflowTokenCredentialArguments(): string[];
 /** Record the real browser build into the capture dir. Called from a capture run, where a
  *  Playwright browser handle is in scope. Write-or-CLEAR semantics: an undefined version
  *  REMOVES any existing sidecar rather than leaving it, so a reused capture dir (e.g. the

package/dist/map-store.js

@@ -52,6 +52,10 @@ function gitProcessEnvironment() {
 function runGit(cwd, args, maxBuffer = 1 << 28) {
     return spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer, env: gitProcessEnvironment() });
 }
+const WORKFLOW_TOKEN_CREDENTIAL_HELPER = '!f() { if [ "$1" = get ]; then printf \'%s\\n\' username=x-access-token "password=$STYLEPROOF_MAP_STORE_TOKEN"; fi; }; f';
+export function workflowTokenCredentialArguments() {
+    return ['-c', 'credential.helper=', '-c', `credential.helper=${WORKFLOW_TOKEN_CREDENTIAL_HELPER}`];
+}
 function parseGitHttpExtraHeaders(configuredHeaders) {
     return configuredHeaders
         .split('\n')
@@ -486,33 +490,27 @@ function pushMapStoreCommit(cwd, temporaryCheckout, remote, branch, authenticati
         return isolatedPush;
     const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
     if (mapStoreToken) {
-        const askpassDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'styleproof-map-store-askpass-'));
-        const askpassScript = path.join(askpassDirectory, 'askpass.sh');
-        fs.writeFileSync(askpassScript, '#!/bin/sh\ncase "$1" in *Username*) printf "%s\\n" x-access-token ;; *) printf "%s\\n" "$STYLEPROOF_MAP_STORE_TOKEN" ;; esac\n', { mode: 0o700 });
-        try {
-            const askpassPush = spawnSync('git', [
-                '-c',
-                `${['http.https:', '', 'github.com', '.extraheader'].join('/')}=`,
-                'push',
-                '-q',
-                'origin',
-                `HEAD:${branch}`,
-            ], {
-                cwd: temporaryCheckout,
-                encoding: 'utf8',
-                maxBuffer: 1 << 20,
-                env: {
-                    ...gitProcessEnvironment(),
-                    GIT_ASKPASS: askpassScript,
-                    GIT_TERMINAL_PROMPT: '0',
-                },
-            });
-            if (askpassPush.status === 0)
-                return askpassPush;
-        }
-        finally {
-            fs.rmSync(askpassDirectory, { recursive: true, force: true });
-        }
+        const githubExtraHeaderKey = ['http.https:', '', 'github.com', '.extraheader'].join('/');
+        runGit(temporaryCheckout, ['config', '--local', '--unset-all', githubExtraHeaderKey], 1 << 20);
+        const credentialPush = spawnSync('git', [
+            '-c',
+            `${githubExtraHeaderKey}=`,
+            ...workflowTokenCredentialArguments(),
+            'push',
+            '-q',
+            'origin',
+            `HEAD:${branch}`,
+        ], {
+            cwd: temporaryCheckout,
+            encoding: 'utf8',
+            maxBuffer: 1 << 20,
+            env: {
+                ...gitProcessEnvironment(),
+                GIT_TERMINAL_PROMPT: '0',
+            },
+        });
+        if (credentialPush.status === 0)
+            return credentialPush;
     }
     const mapStoreCommit = gitOutput(temporaryCheckout, ['rev-parse', 'HEAD']);
     const importCommit = runGit(cwd, ['fetch', '-q', '--no-write-fetch-head', temporaryCheckout, mapStoreCommit], 1 << 20);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.13",
+  "version": "4.4.14",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",