styleproof 4.4.19 → 4.4.21

package/CHANGELOG.md

@@ -7,6 +7,22 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.21] - 2026-07-14
+
+### Fixed
+
+- **GitHub Actions map publication no longer sends duplicate authorization headers.**
+  StyleProof now resets inherited checkout headers before applying the single
+  effective credential to isolated map-store clone and push operations.
+
+## [4.4.20] - 2026-07-14
+
+### Fixed
+
+- **Map-store network operations can no longer wedge CI indefinitely.** Remote
+  lookup, clone, and push commands now have a bounded timeout, and a stalled
+  isolated push falls through to the authenticated consumer checkout path.
+
 ## [4.4.19] - 2026-07-14
 
 ### Fixed

package/dist/map-store.js

@@ -52,6 +52,33 @@ function gitProcessEnvironment() {
 function runGit(cwd, args, maxBuffer = 1 << 28) {
     return spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer, env: gitProcessEnvironment() });
 }
+const DEFAULT_MAP_STORE_GIT_TIMEOUT_MILLISECONDS = 30_000;
+function mapStoreGitTimeoutMilliseconds() {
+    const configuredTimeout = Number(process.env.STYLEPROOF_MAP_STORE_GIT_TIMEOUT_MS);
+    return Number.isFinite(configuredTimeout) && configuredTimeout > 0
+        ? Math.floor(configuredTimeout)
+        : DEFAULT_MAP_STORE_GIT_TIMEOUT_MILLISECONDS;
+}
+function runMapStoreNetworkGit(cwd, args, maxBuffer = 1 << 20) {
+    return spawnSync('git', args, {
+        cwd,
+        encoding: 'utf8',
+        maxBuffer,
+        timeout: mapStoreGitTimeoutMilliseconds(),
+        env: {
+            ...gitProcessEnvironment(),
+            GIT_TERMINAL_PROMPT: '0',
+        },
+    });
+}
+function gitFailureMessage(result, fallback) {
+    const standardError = typeof result.stderr === 'string' ? result.stderr.trim() : '';
+    if (standardError)
+        return standardError;
+    if (result.error)
+        return result.error.message;
+    return fallback;
+}
 const WORKFLOW_TOKEN_CREDENTIAL_HELPER = '!f() { if [ "$1" = get ]; then printf \'%s\\n\' username=x-access-token "password=$STYLEPROOF_MAP_STORE_TOKEN"; fi; }; f';
 export function workflowTokenCredentialArguments() {
     return ['-c', 'credential.helper=', '-c', `credential.helper=${WORKFLOW_TOKEN_CREDENTIAL_HELPER}`];
@@ -67,6 +94,17 @@ function parseGitHttpExtraHeaders(configuredHeaders) {
         return [{ key: configuredHeader.slice(0, separatorIndex), value: configuredHeader.slice(separatorIndex + 1) }];
     });
 }
+function resetInheritedGitHttpExtraHeaders(configuredHeaders) {
+    const resetHeaderKeys = new Set();
+    return configuredHeaders.flatMap((configuredHeader) => {
+        if (resetHeaderKeys.has(configuredHeader.key))
+            return [configuredHeader];
+        resetHeaderKeys.add(configuredHeader.key);
+        return configuredHeader.value === ''
+            ? [configuredHeader]
+            : [{ key: configuredHeader.key, value: '' }, configuredHeader];
+    });
+}
 function effectiveGitHttpExtraHeaders(cwd) {
     const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
     if (mapStoreToken) {
@@ -84,7 +122,7 @@ function effectiveGitHttpExtraHeaders(cwd) {
     const configuredHeaders = runGit(cwd, ['config', '--includes', '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
     const effectiveHeaders = parseGitHttpExtraHeaders(configuredHeaders.stdout);
     if (effectiveHeaders.length > 0)
-        return effectiveHeaders;
+        return resetInheritedGitHttpExtraHeaders(effectiveHeaders);
     const registeredIncludes = runGit(cwd, ['config', '--local', '--get-regexp', '^includeIf\\..*\\.path$'], 1 << 20);
     const includedHeaders = registeredIncludes.stdout
         .split('\n')
@@ -98,7 +136,7 @@ function effectiveGitHttpExtraHeaders(cwd) {
         return parseGitHttpExtraHeaders(includedHeaders.stdout);
     });
     if (includedHeaders.length > 0)
-        return includedHeaders;
+        return resetInheritedGitHttpExtraHeaders(includedHeaders);
     return [];
 }
 function gitOutput(cwd, args) {
@@ -459,19 +497,20 @@ function checkoutMapStore(cwd, remote, branch, sparseSegment) {
     const httpExtraHeaders = effectiveGitHttpExtraHeaders(cwd);
     const authenticationArguments = httpExtraHeaders.flatMap(({ key, value }) => ['-c', `${key}=${value}`]);
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'styleproof-map-store-'));
-    const branchExists = runGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20).status === 0;
+    const branchLookup = runMapStoreNetworkGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20);
+    if (branchLookup.status !== 0 && branchLookup.status !== 2) {
+        fs.rmSync(tmp, { recursive: true, force: true });
+        throw new MapStoreError(gitFailureMessage(branchLookup, 'could not query map store branch'));
+    }
+    const branchExists = branchLookup.status === 0;
     if (branchExists) {
         const cloneArguments = sparseSegment
             ? ['clone', '-q', '--filter=blob:none', '--no-checkout', '--depth', '1', '--single-branch', '--branch', branch]
             : ['clone', '-q', '--depth', '1', '--branch', branch];
-        const clone = spawnSync('git', [...authenticationArguments, ...cloneArguments, remoteUrl, tmp], {
-            encoding: 'utf8',
-            maxBuffer: 1 << 20,
-            env: gitProcessEnvironment(),
-        });
+        const clone = runMapStoreNetworkGit(cwd, [...authenticationArguments, ...cloneArguments, remoteUrl, tmp]);
         if (clone.status !== 0) {
             fs.rmSync(tmp, { recursive: true, force: true });
-            throw new MapStoreError(clone.stderr.trim() || 'could not clone map store branch');
+            throw new MapStoreError(gitFailureMessage(clone, 'could not clone map store branch'));
         }
     }
     else {
@@ -479,22 +518,22 @@ function checkoutMapStore(cwd, remote, branch, sparseSegment) {
         runGit(tmp, ['remote', 'add', 'origin', remoteUrl]);
     }
     for (const { key, value } of httpExtraHeaders)
-        runGit(tmp, ['config', '--local', key, value]);
+        runGit(tmp, ['config', '--local', '--add', key, value]);
     if (sparseSegment && branchExists)
         checkoutSparseSegment(tmp, branch, sparseSegment);
     return tmp;
 }
 function pushMapStoreCommit(cwd, temporaryCheckout, remote, branch, authenticationArguments) {
     const pushFailures = [];
-    const isolatedPush = runGit(temporaryCheckout, [...authenticationArguments, 'push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
+    const isolatedPush = runMapStoreNetworkGit(temporaryCheckout, [...authenticationArguments, 'push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
     if (isolatedPush.status === 0)
         return isolatedPush;
-    pushFailures.push(`isolated map-store push: ${isolatedPush.stderr.trim() || `git exited ${isolatedPush.status}`}`);
+    pushFailures.push(`isolated map-store push: ${gitFailureMessage(isolatedPush, `git exited ${isolatedPush.status}`)}`);
     const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
     if (mapStoreToken) {
         const githubExtraHeaderKey = ['http.https:', '', 'github.com', '.extraheader'].join('/');
         runGit(temporaryCheckout, ['config', '--local', '--unset-all', githubExtraHeaderKey], 1 << 20);
-        const credentialPush = spawnSync('git', [
+        const credentialPush = runMapStoreNetworkGit(temporaryCheckout, [
             '-c',
             `${githubExtraHeaderKey}=`,
             ...workflowTokenCredentialArguments(),
@@ -502,18 +541,10 @@ function pushMapStoreCommit(cwd, temporaryCheckout, remote, branch, authenticati
             '-q',
             'origin',
             `HEAD:${branch}`,
-        ], {
-            cwd: temporaryCheckout,
-            encoding: 'utf8',
-            maxBuffer: 1 << 20,
-            env: {
-                ...gitProcessEnvironment(),
-                GIT_TERMINAL_PROMPT: '0',
-            },
-        });
+        ]);
         if (credentialPush.status === 0)
             return credentialPush;
-        pushFailures.push(`workflow-token credential push: ${credentialPush.stderr.trim() || `git exited ${credentialPush.status}`}`);
+        pushFailures.push(`workflow-token credential push: ${gitFailureMessage(credentialPush, `git exited ${credentialPush.status}`)}`);
     }
     const mapStoreCommit = gitOutput(temporaryCheckout, ['rev-parse', 'HEAD']);
     const importCommit = runGit(cwd, ['fetch', '-q', '--no-write-fetch-head', temporaryCheckout, mapStoreCommit], 1 << 20);
@@ -526,14 +557,14 @@ function pushMapStoreCommit(cwd, temporaryCheckout, remote, branch, authenticati
             ].join('\n'),
         };
     }
-    const consumerCheckoutPush = runGit(cwd, ['push', '-q', remote, `${mapStoreCommit}:${branch}`], 1 << 20);
+    const consumerCheckoutPush = runMapStoreNetworkGit(cwd, ['push', '-q', remote, `${mapStoreCommit}:${branch}`], 1 << 20);
     if (consumerCheckoutPush.status === 0)
         return consumerCheckoutPush;
     return {
         ...consumerCheckoutPush,
         stderr: [
             ...pushFailures,
-            `consumer checkout push: ${consumerCheckoutPush.stderr.trim() || `git exited ${consumerCheckoutPush.status}`}`,
+            `consumer checkout push: ${gitFailureMessage(consumerCheckoutPush, `git exited ${consumerCheckoutPush.status}`)}`,
         ].join('\n'),
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.19",
+  "version": "4.4.21",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",