styleproof 4.4.17 → 4.4.19

package/CHANGELOG.md

@@ -7,6 +7,23 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.19] - 2026-07-14
+
+### Fixed
+
+- **Generated cache restores now evaluate each map in its own commit context.**
+  CI checks out the base before restoring the base bundle and returns to the head
+  before restoring the head bundle, so lockfile-changing pull requests reach the
+  browserless hot path after their first published pair.
+
+## [4.4.18] - 2026-07-13
+
+### Fixed
+
+- **Generated cold-cache workflows now publish from a clean tracked tree.** Yarn,
+  pnpm, and Bun restore only the package metadata changed by the temporary exact
+  StyleProof install while retaining that release in `node_modules` for capture.
+
 ## [4.4.17] - 2026-07-13
 
 ### Fixed

package/bin/styleproof-init.mjs

@@ -222,6 +222,7 @@ const PACKAGE_MANAGERS = {
     exec: (command) => `npx ${command}`,
     install: 'npm ci',
     installExactStyleProof: 'npm install --no-save --package-lock=false "styleproof@$STYLEPROOF_VERSION"',
+    restorePackageMetadata: 'true # npm exact install leaves package metadata unchanged',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -233,6 +234,7 @@ const PACKAGE_MANAGERS = {
     exec: (command) => `npx -y yarn@1.22.22 ${command}`,
     install: 'npx -y yarn@1.22.22 install --frozen-lockfile --non-interactive',
     installExactStyleProof: 'npx -y yarn@1.22.22 add --dev --exact "styleproof@$STYLEPROOF_VERSION"',
+    restorePackageMetadata: 'git checkout -- package.json yarn.lock',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -245,6 +247,7 @@ const PACKAGE_MANAGERS = {
     exec: (command) => `pnpm exec ${command}`,
     install: 'pnpm install --frozen-lockfile',
     installExactStyleProof: 'pnpm add --save-dev --save-exact "styleproof@$STYLEPROOF_VERSION"',
+    restorePackageMetadata: 'git checkout -- package.json pnpm-lock.yaml',
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -258,6 +261,12 @@ const PACKAGE_MANAGERS = {
     exec: (command) => `bunx ${command}`,
     install: 'bun install --frozen-lockfile',
     installExactStyleProof: 'bun add --dev --exact "styleproof@$STYLEPROOF_VERSION"',
+    restorePackageMetadata: `git checkout -- package.json
+            for package_metadata_file in bun.lock bun.lockb; do
+              if git ls-files --error-unmatch "$package_metadata_file" >/dev/null 2>&1; then
+                git checkout -- "$package_metadata_file"
+              fi
+            done`,
     setup: `      - uses: actions/setup-node@v4
         with:
           node-version: '20'
@@ -406,9 +415,16 @@ ${PM.setup}
           HEAD_SHA="\${{ github.event.pull_request.head.sha }}"
           MAP_ROOT="\${{ runner.temp }}/styleproof-maps"
           rm -rf "$MAP_ROOT"
+          # Compatibility keys include the checked-out lockfile. Resolve each
+          # exact-SHA bundle in that commit's own dependency context, while
+          # reusing the already-installed StyleProof binary from node_modules.
+          git checkout --force "$BASE_SHA"
           set +e
           PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --restore --sha "$BASE_SHA" --dir base --base-dir "$MAP_ROOT" --spec ${specPath}
           base_code=$?
+          set -e
+          git checkout --force "$HEAD_SHA"
+          set +e
           PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --restore --sha "$HEAD_SHA" --dir head --base-dir "$MAP_ROOT" --spec ${specPath}
           head_code=$?
           set -e
@@ -439,6 +455,10 @@ ${PM.setup}
             # exact release, then invoke its binary directly so a later package
             # manager command cannot silently reconcile node_modules backwards.
             ${PM.installExactStyleProof}
+            # Package managers that record the temporary exact release dirty
+            # tracked metadata. Restore only those files: node_modules must
+            # retain the exact release for the clean-tree capture below.
+            ${PM.restorePackageMetadata}
             PATH="$PWD/node_modules/.bin:$PATH" playwright install --with-deps chromium
             if [ -f "${specPath}" ]; then
               PATH="$PWD/node_modules/.bin:$PATH" node node_modules/styleproof/bin/styleproof-map.mjs --spec ${specPath} --dir base --base-dir "$MAP_ROOT" --keep-har --sha "$BASE_SHA" --upload

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.17",
+  "version": "4.4.19",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",