styleproof 4.4.6 → 4.4.7

package/CHANGELOG.md

@@ -9,6 +9,11 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ### Fixed
 
+- **Generated CI authenticates map publication explicitly.** `styleproof-init`
+  passes the workflow's least-privilege `github.token` as
+  `STYLEPROOF_MAP_STORE_TOKEN`, so cold-cache uploads do not depend on private
+  `actions/checkout` credential-storage details. Local hooks continue to reuse
+  normal Git credentials without requiring this variable.
 - **Map-store uploads now reuse credentials from `actions/checkout@v7`.**
   Checkout v7 keeps its HTTP header in an included temporary config rather than
   directly in `.git/config`; StyleProof now explicitly enables Git config includes

package/bin/styleproof-init.mjs

@@ -388,6 +388,8 @@ jobs:
     # Report on open/update; the prune job below handles close.
     if: github.event.action != 'closed'
     runs-on: ubuntu-latest
+    env:
+      STYLEPROOF_MAP_STORE_TOKEN: \${{ github.token }}
     steps:
       - uses: actions/checkout@v4
         with:

package/dist/map-store.js

@@ -69,7 +69,7 @@ function effectiveGitHttpExtraHeaders(cwd) {
     if (effectiveHeaders.length > 0)
         return effectiveHeaders;
     const registeredIncludes = runGit(cwd, ['config', '--local', '--get-regexp', '^includeIf\\..*\\.path$'], 1 << 20);
-    return registeredIncludes.stdout
+    const includedHeaders = registeredIncludes.stdout
         .split('\n')
         .filter(Boolean)
         .flatMap((registeredInclude) => {
@@ -80,6 +80,17 @@ function effectiveGitHttpExtraHeaders(cwd) {
         const includedHeaders = runGit(cwd, ['config', '--file', includedConfigPath, '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
         return parseGitHttpExtraHeaders(includedHeaders.stdout);
     });
+    if (includedHeaders.length > 0)
+        return includedHeaders;
+    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
+    if (!mapStoreToken)
+        return [];
+    return [
+        {
+            key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
+            value: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${mapStoreToken}`).toString('base64')}`,
+        },
+    ];
 }
 function gitOutput(cwd, args) {
     const r = runGit(cwd, args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.6",
+  "version": "4.4.7",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",