styleproof 4.4.5 → 4.4.7

package/CHANGELOG.md

@@ -9,10 +9,16 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ### Fixed
 
+- **Generated CI authenticates map publication explicitly.** `styleproof-init`
+  passes the workflow's least-privilege `github.token` as
+  `STYLEPROOF_MAP_STORE_TOKEN`, so cold-cache uploads do not depend on private
+  `actions/checkout` credential-storage details. Local hooks continue to reuse
+  normal Git credentials without requiring this variable.
 - **Map-store uploads now reuse credentials from `actions/checkout@v7`.**
   Checkout v7 keeps its HTTP header in an included temporary config rather than
   directly in `.git/config`; StyleProof now explicitly enables Git config includes
-  before carrying that header into its isolated clone and push.
+  and falls back to its locally registered checkout config before carrying that
+  header into the isolated clone and push.
 - **Map-store uploads now reuse the HTTP authentication persisted by
   `actions/checkout`.** The isolated `styleproof-maps` clone carries the
   checkout's URL-scoped extra header through clone and push, so cache-miss

package/bin/styleproof-init.mjs

@@ -388,6 +388,8 @@ jobs:
     # Report on open/update; the prune job below handles close.
     if: github.event.action != 'closed'
     runs-on: ubuntu-latest
+    env:
+      STYLEPROOF_MAP_STORE_TOKEN: \${{ github.token }}
     steps:
       - uses: actions/checkout@v4
         with:

package/dist/map-store.js

@@ -52,24 +52,45 @@ function gitProcessEnvironment() {
 function runGit(cwd, args, maxBuffer = 1 << 28) {
     return spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer, env: gitProcessEnvironment() });
 }
-function effectiveGitHttpExtraHeaders(cwd) {
-    const configuredHeaders = runGit(cwd, ['config', '--includes', '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
-    if (configuredHeaders.status !== 0)
-        return [];
-    return configuredHeaders.stdout
+function parseGitHttpExtraHeaders(configuredHeaders) {
+    return configuredHeaders
         .split('\n')
         .filter(Boolean)
         .flatMap((configuredHeader) => {
         const separatorIndex = configuredHeader.indexOf(' ');
         if (separatorIndex === -1)
             return [];
-        return [
-            {
-                key: configuredHeader.slice(0, separatorIndex),
-                value: configuredHeader.slice(separatorIndex + 1),
-            },
-        ];
+        return [{ key: configuredHeader.slice(0, separatorIndex), value: configuredHeader.slice(separatorIndex + 1) }];
+    });
+}
+function effectiveGitHttpExtraHeaders(cwd) {
+    const configuredHeaders = runGit(cwd, ['config', '--includes', '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
+    const effectiveHeaders = parseGitHttpExtraHeaders(configuredHeaders.stdout);
+    if (effectiveHeaders.length > 0)
+        return effectiveHeaders;
+    const registeredIncludes = runGit(cwd, ['config', '--local', '--get-regexp', '^includeIf\\..*\\.path$'], 1 << 20);
+    const includedHeaders = registeredIncludes.stdout
+        .split('\n')
+        .filter(Boolean)
+        .flatMap((registeredInclude) => {
+        const separatorIndex = registeredInclude.indexOf(' ');
+        if (separatorIndex === -1)
+            return [];
+        const includedConfigPath = registeredInclude.slice(separatorIndex + 1);
+        const includedHeaders = runGit(cwd, ['config', '--file', includedConfigPath, '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
+        return parseGitHttpExtraHeaders(includedHeaders.stdout);
     });
+    if (includedHeaders.length > 0)
+        return includedHeaders;
+    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
+    if (!mapStoreToken)
+        return [];
+    return [
+        {
+            key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
+            value: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${mapStoreToken}`).toString('base64')}`,
+        },
+    ];
 }
 function gitOutput(cwd, args) {
     const r = runGit(cwd, args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.5",
+  "version": "4.4.7",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",