styleproof 4.4.6 → 4.4.8

package/CHANGELOG.md

@@ -7,8 +7,33 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.8] - 2026-07-13
+
+### Fixed
+
+- **Map-store restore now retrieves only the requested commit bundle.** Restore
+  clones branch metadata without a checkout, sparsely selects the requested SHA,
+  and, on partial-clone-capable remotes such as GitHub, downloads only that
+  bundle's blobs. Large long-lived map stores therefore no longer make every
+  cache lookup clone all historical bundles on supported remotes. Publishing
+  uses the same sparse checkout and stages only the requested bundle plus the
+  store README; Git's sparse index preserves unseen bundles without downloading
+  their blobs, so cache misses no longer materialise the complete store either.
+
+## [4.4.7] - 2026-07-13
+
 ### Fixed
 
+- **Generated CI authenticates map publication explicitly.** `styleproof-init`
+  passes the workflow's least-privilege `github.token` as
+  `STYLEPROOF_MAP_STORE_TOKEN`, so cold-cache uploads do not depend on private
+  `actions/checkout` credential-storage details. Local hooks continue to reuse
+  normal Git credentials without requiring this variable.
+- **Map-store uploads now reuse credentials from `actions/checkout@v7`.**
+  Checkout v7 keeps its HTTP header in an included temporary config rather than
+  directly in `.git/config`; StyleProof now explicitly enables Git config includes
+  and falls back to its locally registered checkout config before carrying that
+  header into the isolated clone and push.
 - **Map-store uploads now reuse credentials from `actions/checkout@v7`.**
   Checkout v7 keeps its HTTP header in an included temporary config rather than
   directly in `.git/config`; StyleProof now explicitly enables Git config includes

package/bin/styleproof-init.mjs

@@ -388,6 +388,8 @@ jobs:
     # Report on open/update; the prune job below handles close.
     if: github.event.action != 'closed'
     runs-on: ubuntu-latest
+    env:
+      STYLEPROOF_MAP_STORE_TOKEN: \${{ github.token }}
     steps:
       - uses: actions/checkout@v4
         with:

package/dist/map-store.js

@@ -69,7 +69,7 @@ function effectiveGitHttpExtraHeaders(cwd) {
     if (effectiveHeaders.length > 0)
         return effectiveHeaders;
     const registeredIncludes = runGit(cwd, ['config', '--local', '--get-regexp', '^includeIf\\..*\\.path$'], 1 << 20);
-    return registeredIncludes.stdout
+    const includedHeaders = registeredIncludes.stdout
         .split('\n')
         .filter(Boolean)
         .flatMap((registeredInclude) => {
@@ -80,6 +80,17 @@ function effectiveGitHttpExtraHeaders(cwd) {
         const includedHeaders = runGit(cwd, ['config', '--file', includedConfigPath, '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
         return parseGitHttpExtraHeaders(includedHeaders.stdout);
     });
+    if (includedHeaders.length > 0)
+        return includedHeaders;
+    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
+    if (!mapStoreToken)
+        return [];
+    return [
+        {
+            key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
+            value: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${mapStoreToken}`).toString('base64')}`,
+        },
+    ];
 }
 function gitOutput(cwd, args) {
     const r = runGit(cwd, args);
@@ -424,15 +435,27 @@ function copyDir(src, dest, includeHar) {
         filter: (source) => includeHar || !source.endsWith('.har'),
     });
 }
-function checkoutMapStore(cwd, remote, branch) {
+function checkoutSparseSegment(tmp, branch, segment) {
+    const sparseCheckout = runGit(tmp, ['sparse-checkout', 'set', segment], 1 << 20);
+    const checkout = sparseCheckout.status === 0 ? runGit(tmp, ['checkout', '-q', branch], 1 << 20) : sparseCheckout;
+    if (checkout.status !== 0) {
+        fs.rmSync(tmp, { recursive: true, force: true });
+        throw new MapStoreError(checkout.stderr.trim() || `could not check out ${segment} from map store`);
+    }
+}
+function checkoutMapStore(cwd, remote, branch, sparseSegment) {
     if (!remoteExists(remote, cwd))
         throw new MapStoreError(`git remote ${remote} was not found`);
     const remoteUrl = gitOutput(cwd, ['remote', 'get-url', remote]);
     const httpExtraHeaders = effectiveGitHttpExtraHeaders(cwd);
     const authenticationArguments = httpExtraHeaders.flatMap(({ key, value }) => ['-c', `${key}=${value}`]);
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'styleproof-map-store-'));
-    if (runGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20).status === 0) {
-        const clone = spawnSync('git', [...authenticationArguments, 'clone', '-q', '--depth', '1', '--branch', branch, remoteUrl, tmp], {
+    const branchExists = runGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20).status === 0;
+    if (branchExists) {
+        const cloneArguments = sparseSegment
+            ? ['clone', '-q', '--filter=blob:none', '--no-checkout', '--depth', '1', '--single-branch', '--branch', branch]
+            : ['clone', '-q', '--depth', '1', '--branch', branch];
+        const clone = spawnSync('git', [...authenticationArguments, ...cloneArguments, remoteUrl, tmp], {
             encoding: 'utf8',
             maxBuffer: 1 << 20,
             env: gitProcessEnvironment(),
@@ -448,6 +471,8 @@ function checkoutMapStore(cwd, remote, branch) {
     }
     for (const { key, value } of httpExtraHeaders)
         runGit(tmp, ['config', '--local', key, value]);
+    if (sparseSegment && branchExists)
+        checkoutSparseSegment(tmp, branch, sparseSegment);
     return tmp;
 }
 export function publishMapBundle(options) {
@@ -468,7 +493,7 @@ export function publishMapBundle(options) {
     let ok = false;
     let lastError = '';
     for (let attempt = 1; attempt <= 5; attempt++) {
-        const tmp = checkoutMapStore(cwd, remote, branch);
+        const tmp = checkoutMapStore(cwd, remote, branch, sha);
         try {
             runGit(tmp, ['config', 'user.name', 'github-actions[bot]']);
             runGit(tmp, ['config', 'user.email', '41898282+github-actions[bot]@users.noreply.github.com']);
@@ -478,7 +503,7 @@ export function publishMapBundle(options) {
             if (!options.includeHar) {
                 fs.writeFileSync(path.join(tmp, target, MAP_MANIFEST), JSON.stringify({ ...manifest, har: false }, null, 2));
             }
-            runGit(tmp, ['add', '-A']);
+            runGit(tmp, ['add', '-A', '--sparse', '--', 'README.md', target]);
             runGit(tmp, ['commit', '-q', '-m', `StyleProof map ${sha.slice(0, 12)} ${compatibilityKey}`], 1 << 20);
             const push = runGit(tmp, ['push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
             if (push.status === 0) {
@@ -509,7 +534,7 @@ export function restoreMapBundle(options) {
     if (runGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20).status !== 0) {
         throw new MapStoreError(`map store branch ${branch} does not exist`);
     }
-    const tmp = checkoutMapStore(cwd, remote, branch);
+    const tmp = checkoutMapStore(cwd, remote, branch, sha);
     try {
         const shaDir = path.join(tmp, sha);
         if (!fs.existsSync(shaDir))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.6",
+  "version": "4.4.8",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",