styleproof 4.4.15 → 4.4.17

package/CHANGELOG.md

@@ -7,6 +7,27 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.17] - 2026-07-13
+
+### Fixed
+
+- **Generated cache-first CI now preserves the installed StyleProof release across
+  base checkouts.** Cold-cache capture installs the head's exact release into an
+  older base checkout and invokes the installed binary directly, preventing package
+  manager reconciliation from silently running the base's older capture logic.
+- **Generated workflows now reuse checkout authentication for map publication.**
+  The redundant map-store token environment variable is omitted; the persisted
+  checkout credential supplies the existing least-privilege `contents: write` path.
+
+## [4.4.16] - 2026-07-13
+
+### Fixed
+
+- **Map-store publication now retains failures that occur while preparing a retry.**
+  If an authenticated push fails and the next clone also fails, StyleProof reports
+  both errors with their attempt and phase instead of replacing the actionable push
+  failure with the later setup error.
+
 ## [4.4.15] - 2026-07-13
 
 ### Fixed

package/bin/styleproof-init.mjs

@@ -221,6 +221,7 @@ const PACKAGE_MANAGERS = {
     run: (script) => `npm run ${script}`,
     exec: (command) => `npx ${command}`,
     install: 'npm ci',
+    installExactStyleProof: 'npm install --no-save --package-lock=false "styleproof@$STYLEPROOF_VERSION"',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -231,6 +232,7 @@ const PACKAGE_MANAGERS = {
     run: (script) => `npx -y yarn@1.22.22 ${script}`,
     exec: (command) => `npx -y yarn@1.22.22 ${command}`,
     install: 'npx -y yarn@1.22.22 install --frozen-lockfile --non-interactive',
+    installExactStyleProof: 'npx -y yarn@1.22.22 add --dev --exact "styleproof@$STYLEPROOF_VERSION"',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -242,6 +244,7 @@ const PACKAGE_MANAGERS = {
     run: (script) => `pnpm run ${script}`,
     exec: (command) => `pnpm exec ${command}`,
     install: 'pnpm install --frozen-lockfile',
+    installExactStyleProof: 'pnpm add --save-dev --save-exact "styleproof@$STYLEPROOF_VERSION"',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -254,6 +257,7 @@ const PACKAGE_MANAGERS = {
     run: (script) => `bun run ${script}`,
     exec: (command) => `bunx ${command}`,
     install: 'bun install --frozen-lockfile',
+    installExactStyleProof: 'bun add --dev --exact "styleproof@$STYLEPROOF_VERSION"',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -388,8 +392,6 @@ jobs:
     # Report on open/update; the prune job below handles close.
     if: github.event.action != 'closed'
     runs-on: ubuntu-latest
-    env:
-      STYLEPROOF_MAP_STORE_TOKEN: \${{ github.token }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -405,9 +407,9 @@ ${PM.setup}
           MAP_ROOT="\${{ runner.temp }}/styleproof-maps"
           rm -rf "$MAP_ROOT"
           set +e
-          ${PM.exec(`styleproof-map --restore --sha "$BASE_SHA" --dir base --base-dir "$MAP_ROOT" --spec ${specPath}`)}
+          PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --restore --sha "$BASE_SHA" --dir base --base-dir "$MAP_ROOT" --spec ${specPath}
           base_code=$?
-          ${PM.exec(`styleproof-map --restore --sha "$HEAD_SHA" --dir head --base-dir "$MAP_ROOT" --spec ${specPath}`)}
+          PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --restore --sha "$HEAD_SHA" --dir head --base-dir "$MAP_ROOT" --spec ${specPath}
           head_code=$?
           set -e
           echo "base-hit=$([ "$base_code" -eq 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
@@ -421,37 +423,43 @@ ${PM.setup}
         if: steps.maps.outputs.capture-needed == 'true'
         shell: bash
         run: |
+          set -euo pipefail
           BASE_SHA="\${{ github.event.pull_request.base.sha }}"
           HEAD_SHA="\${{ github.event.pull_request.head.sha }}"
           MAP_ROOT="\${{ runner.temp }}/styleproof-maps"
+          STYLEPROOF_VERSION="$(node -p "require('./node_modules/styleproof/package.json').version")"
 
           if [ "\${{ steps.maps.outputs.base-hit }}" != 'true' ]; then
             # Without a compatible base bundle, rebuild and publish the pair in
             # one pinned environment. This is the expensive cold path.
             rm -rf "$MAP_ROOT"
-            git checkout "$BASE_SHA"
+            git checkout --force "$BASE_SHA"
             ${PM.install}
-            ${PM.exec('playwright install --with-deps chromium')}
+            # The base may depend on an older StyleProof. Install the head's
+            # exact release, then invoke its binary directly so a later package
+            # manager command cannot silently reconcile node_modules backwards.
+            ${PM.installExactStyleProof}
+            PATH="$PWD/node_modules/.bin:$PATH" playwright install --with-deps chromium
             if [ -f "${specPath}" ]; then
-              ${PM.exec(`styleproof-map --spec ${specPath} --dir base --base-dir "$MAP_ROOT" --keep-har --sha "$BASE_SHA" --upload`)}
+              PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --spec ${specPath} --dir base --base-dir "$MAP_ROOT" --keep-har --sha "$BASE_SHA" --upload
             else
               mkdir -p "$MAP_ROOT/base"
             fi
 
-            git checkout "$HEAD_SHA"
+            git checkout --force "$HEAD_SHA"
             ${PM.install}
-            ${PM.exec('playwright install --with-deps chromium')}
+            PATH="$PWD/node_modules/.bin:$PATH" playwright install --with-deps chromium
           else
             # A compatible base hit proves the current head environment. Keep
             # that restored base and capture only the missing head.
             rm -rf "$MAP_ROOT/head"
-            ${PM.exec('playwright install --with-deps chromium')}
+            PATH="$PWD/node_modules/.bin:$PATH" playwright install --with-deps chromium
           fi
 
           if find "$MAP_ROOT/base" -name '*.har' -print -quit | grep -q .; then
-            STYLEPROOF_REPLAY_FROM="$MAP_ROOT/base" ${PM.exec(`styleproof-map --spec ${specPath} --dir head --base-dir "$MAP_ROOT" --sha "$HEAD_SHA" --upload`)}
+            PATH="$PWD/node_modules/.bin:$PATH" STYLEPROOF_REPLAY_FROM="$MAP_ROOT/base" node node_modules/styleproof/bin/styleproof-map.mjs --spec ${specPath} --dir head --base-dir "$MAP_ROOT" --sha "$HEAD_SHA" --upload
           else
-            ${PM.exec(`styleproof-map --spec ${specPath} --dir head --base-dir "$MAP_ROOT" --sha "$HEAD_SHA" --upload`)}
+            PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --spec ${specPath} --dir head --base-dir "$MAP_ROOT" --sha "$HEAD_SHA" --upload
           fi
       - uses: BenSheridanEdwards/StyleProof@v4
         with:

package/dist/map-store.js

@@ -537,6 +537,37 @@ function pushMapStoreCommit(cwd, temporaryCheckout, remote, branch, authenticati
         ].join('\n'),
     };
 }
+function removeTemporaryMapStoreCheckout(temporaryCheckout) {
+    if (temporaryCheckout)
+        fs.rmSync(temporaryCheckout, { recursive: true, force: true });
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function publishMapStoreAttempt(options) {
+    let temporaryCheckout;
+    try {
+        temporaryCheckout = checkoutMapStore(options.cwd, options.remote, options.branch, options.sha);
+        runGit(temporaryCheckout, ['config', 'user.name', 'github-actions[bot]']);
+        runGit(temporaryCheckout, ['config', 'user.email', '41898282+github-actions[bot]@users.noreply.github.com']);
+        fs.writeFileSync(path.join(temporaryCheckout, 'README.md'), '# StyleProof maps\n\nMachine-generated reusable map bundles. Each folder is keyed by commit SHA and capture compatibility.\n');
+        fs.rmSync(path.join(temporaryCheckout, options.target), { recursive: true, force: true });
+        copyDir(options.dir, path.join(temporaryCheckout, options.target), options.includeHar);
+        if (!options.includeHar) {
+            fs.writeFileSync(path.join(temporaryCheckout, options.target, MAP_MANIFEST), JSON.stringify({ ...options.manifest, har: false }, null, 2));
+        }
+        runGit(temporaryCheckout, ['add', '-A', '--sparse', '--', 'README.md', options.target]);
+        runGit(temporaryCheckout, ['commit', '-q', '-m', `StyleProof map ${options.sha.slice(0, 12)} ${options.compatibilityKey}`], 1 << 20);
+        const push = pushMapStoreCommit(options.cwd, temporaryCheckout, options.remote, options.branch, options.authenticationArguments);
+        return { ok: push.status === 0, phase: 'publish', error: push.stderr.trim() || `git exited ${push.status}` };
+    }
+    catch (error) {
+        return { ok: false, phase: 'setup', error: errorMessage(error) };
+    }
+    finally {
+        removeTemporaryMapStoreCheckout(temporaryCheckout);
+    }
+}
 export function publishMapBundle(options) {
     const cwd = options.cwd ?? process.cwd();
     const branch = options.branch ?? DEFAULT_MAP_STORE_BRANCH;
@@ -558,29 +589,26 @@ export function publishMapBundle(options) {
     ]);
     let ok = false;
     let lastError = '';
+    const attemptFailures = [];
     for (let attempt = 1; attempt <= 5; attempt++) {
-        const tmp = checkoutMapStore(cwd, remote, branch, sha);
-        try {
-            runGit(tmp, ['config', 'user.name', 'github-actions[bot]']);
-            runGit(tmp, ['config', 'user.email', '41898282+github-actions[bot]@users.noreply.github.com']);
-            fs.writeFileSync(path.join(tmp, 'README.md'), '# StyleProof maps\n\nMachine-generated reusable map bundles. Each folder is keyed by commit SHA and capture compatibility.\n');
-            fs.rmSync(path.join(tmp, target), { recursive: true, force: true });
-            copyDir(options.dir, path.join(tmp, target), options.includeHar === true);
-            if (!options.includeHar) {
-                fs.writeFileSync(path.join(tmp, target, MAP_MANIFEST), JSON.stringify({ ...manifest, har: false }, null, 2));
-            }
-            runGit(tmp, ['add', '-A', '--sparse', '--', 'README.md', target]);
-            runGit(tmp, ['commit', '-q', '-m', `StyleProof map ${sha.slice(0, 12)} ${compatibilityKey}`], 1 << 20);
-            const push = pushMapStoreCommit(cwd, tmp, remote, branch, pushAuthenticationArguments);
-            if (push.status === 0) {
-                ok = true;
-                break;
-            }
-            lastError = push.stderr.trim();
-        }
-        finally {
-            fs.rmSync(tmp, { recursive: true, force: true });
+        const result = publishMapStoreAttempt({
+            cwd,
+            remote,
+            branch,
+            sha,
+            compatibilityKey,
+            target,
+            dir: options.dir,
+            includeHar: options.includeHar === true,
+            manifest,
+            authenticationArguments: pushAuthenticationArguments,
+        });
+        if (result.ok) {
+            ok = true;
+            break;
         }
+        attemptFailures.push(`attempt ${attempt} ${result.phase}:\n${result.error}`);
+        lastError = attemptFailures.join('\n');
         Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, attempt * 250);
     }
     if (!ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.15",
+  "version": "4.4.17",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",