styleproof 4.4.16 → 4.4.18

package/CHANGELOG.md

@@ -7,6 +7,26 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.18] - 2026-07-13
+
+### Fixed
+
+- **Generated cold-cache workflows now publish from a clean tracked tree.** Yarn,
+  pnpm, and Bun restore only the package metadata changed by the temporary exact
+  StyleProof install while retaining that release in `node_modules` for capture.
+
+## [4.4.17] - 2026-07-13
+
+### Fixed
+
+- **Generated cache-first CI now preserves the installed StyleProof release across
+  base checkouts.** Cold-cache capture installs the head's exact release into an
+  older base checkout and invokes the installed binary directly, preventing package
+  manager reconciliation from silently running the base's older capture logic.
+- **Generated workflows now reuse checkout authentication for map publication.**
+  The redundant map-store token environment variable is omitted; the persisted
+  checkout credential supplies the existing least-privilege `contents: write` path.
+
 ## [4.4.16] - 2026-07-13
 
 ### Fixed

package/bin/styleproof-init.mjs

@@ -221,6 +221,8 @@ const PACKAGE_MANAGERS = {
     run: (script) => `npm run ${script}`,
     exec: (command) => `npx ${command}`,
     install: 'npm ci',
+    installExactStyleProof: 'npm install --no-save --package-lock=false "styleproof@$STYLEPROOF_VERSION"',
+    restorePackageMetadata: 'true # npm exact install leaves package metadata unchanged',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -231,6 +233,8 @@ const PACKAGE_MANAGERS = {
     run: (script) => `npx -y yarn@1.22.22 ${script}`,
     exec: (command) => `npx -y yarn@1.22.22 ${command}`,
     install: 'npx -y yarn@1.22.22 install --frozen-lockfile --non-interactive',
+    installExactStyleProof: 'npx -y yarn@1.22.22 add --dev --exact "styleproof@$STYLEPROOF_VERSION"',
+    restorePackageMetadata: 'git checkout -- package.json yarn.lock',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -242,6 +246,8 @@ const PACKAGE_MANAGERS = {
     run: (script) => `pnpm run ${script}`,
     exec: (command) => `pnpm exec ${command}`,
     install: 'pnpm install --frozen-lockfile',
+    installExactStyleProof: 'pnpm add --save-dev --save-exact "styleproof@$STYLEPROOF_VERSION"',
+    restorePackageMetadata: 'git checkout -- package.json pnpm-lock.yaml',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -254,6 +260,13 @@ const PACKAGE_MANAGERS = {
     run: (script) => `bun run ${script}`,
     exec: (command) => `bunx ${command}`,
     install: 'bun install --frozen-lockfile',
+    installExactStyleProof: 'bun add --dev --exact "styleproof@$STYLEPROOF_VERSION"',
+    restorePackageMetadata: `git checkout -- package.json
+            for package_metadata_file in bun.lock bun.lockb; do
+              if git ls-files --error-unmatch "$package_metadata_file" >/dev/null 2>&1; then
+                git checkout -- "$package_metadata_file"
+              fi
+            done`,
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -388,8 +401,6 @@ jobs:
     # Report on open/update; the prune job below handles close.
     if: github.event.action != 'closed'
     runs-on: ubuntu-latest
-    env:
-      STYLEPROOF_MAP_STORE_TOKEN: \${{ github.token }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -405,9 +416,9 @@ ${PM.setup}
           MAP_ROOT="\${{ runner.temp }}/styleproof-maps"
           rm -rf "$MAP_ROOT"
           set +e
-          ${PM.exec(`styleproof-map --restore --sha "$BASE_SHA" --dir base --base-dir "$MAP_ROOT" --spec ${specPath}`)}
+          PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --restore --sha "$BASE_SHA" --dir base --base-dir "$MAP_ROOT" --spec ${specPath}
           base_code=$?
-          ${PM.exec(`styleproof-map --restore --sha "$HEAD_SHA" --dir head --base-dir "$MAP_ROOT" --spec ${specPath}`)}
+          PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --restore --sha "$HEAD_SHA" --dir head --base-dir "$MAP_ROOT" --spec ${specPath}
           head_code=$?
           set -e
           echo "base-hit=$([ "$base_code" -eq 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
@@ -421,37 +432,47 @@ ${PM.setup}
         if: steps.maps.outputs.capture-needed == 'true'
         shell: bash
         run: |
+          set -euo pipefail
           BASE_SHA="\${{ github.event.pull_request.base.sha }}"
           HEAD_SHA="\${{ github.event.pull_request.head.sha }}"
           MAP_ROOT="\${{ runner.temp }}/styleproof-maps"
+          STYLEPROOF_VERSION="$(node -p "require('./node_modules/styleproof/package.json').version")"
 
           if [ "\${{ steps.maps.outputs.base-hit }}" != 'true' ]; then
             # Without a compatible base bundle, rebuild and publish the pair in
             # one pinned environment. This is the expensive cold path.
             rm -rf "$MAP_ROOT"
-            git checkout "$BASE_SHA"
+            git checkout --force "$BASE_SHA"
             ${PM.install}
-            ${PM.exec('playwright install --with-deps chromium')}
+            # The base may depend on an older StyleProof. Install the head's
+            # exact release, then invoke its binary directly so a later package
+            # manager command cannot silently reconcile node_modules backwards.
+            ${PM.installExactStyleProof}
+            # Package managers that record the temporary exact release dirty
+            # tracked metadata. Restore only those files: node_modules must
+            # retain the exact release for the clean-tree capture below.
+            ${PM.restorePackageMetadata}
+            PATH="$PWD/node_modules/.bin:$PATH" playwright install --with-deps chromium
             if [ -f "${specPath}" ]; then
-              ${PM.exec(`styleproof-map --spec ${specPath} --dir base --base-dir "$MAP_ROOT" --keep-har --sha "$BASE_SHA" --upload`)}
+              PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --spec ${specPath} --dir base --base-dir "$MAP_ROOT" --keep-har --sha "$BASE_SHA" --upload
             else
               mkdir -p "$MAP_ROOT/base"
             fi
 
-            git checkout "$HEAD_SHA"
+            git checkout --force "$HEAD_SHA"
             ${PM.install}
-            ${PM.exec('playwright install --with-deps chromium')}
+            PATH="$PWD/node_modules/.bin:$PATH" playwright install --with-deps chromium
           else
             # A compatible base hit proves the current head environment. Keep
             # that restored base and capture only the missing head.
             rm -rf "$MAP_ROOT/head"
-            ${PM.exec('playwright install --with-deps chromium')}
+            PATH="$PWD/node_modules/.bin:$PATH" playwright install --with-deps chromium
           fi
 
           if find "$MAP_ROOT/base" -name '*.har' -print -quit | grep -q .; then
-            STYLEPROOF_REPLAY_FROM="$MAP_ROOT/base" ${PM.exec(`styleproof-map --spec ${specPath} --dir head --base-dir "$MAP_ROOT" --sha "$HEAD_SHA" --upload`)}
+            PATH="$PWD/node_modules/.bin:$PATH" STYLEPROOF_REPLAY_FROM="$MAP_ROOT/base" node node_modules/styleproof/bin/styleproof-map.mjs --spec ${specPath} --dir head --base-dir "$MAP_ROOT" --sha "$HEAD_SHA" --upload
           else
-            ${PM.exec(`styleproof-map --spec ${specPath} --dir head --base-dir "$MAP_ROOT" --sha "$HEAD_SHA" --upload`)}
+            PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --spec ${specPath} --dir head --base-dir "$MAP_ROOT" --sha "$HEAD_SHA" --upload
           fi
       - uses: BenSheridanEdwards/StyleProof@v4
         with:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.16",
+  "version": "4.4.18",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",