styleproof 4.4.7 → 4.4.9

package/CHANGELOG.md

@@ -7,8 +7,27 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.8] - 2026-07-13
+
+### Fixed
+
+- **Map-store restore now retrieves only the requested commit bundle.** Restore
+  clones branch metadata without a checkout, sparsely selects the requested SHA,
+  and, on partial-clone-capable remotes such as GitHub, downloads only that
+  bundle's blobs. Large long-lived map stores therefore no longer make every
+  cache lookup clone all historical bundles on supported remotes. Publishing
+  uses the same sparse checkout and stages only the requested bundle plus the
+  store README; Git's sparse index preserves unseen bundles without downloading
+  their blobs, so cache misses no longer materialise the complete store either.
+
+## [4.4.7] - 2026-07-13
+
 ### Fixed
 
+- **Explicit map-store credentials take precedence over checkout state.** When
+  `STYLEPROOF_MAP_STORE_TOKEN` is set, StyleProof now uses it before inspecting
+  persisted Git headers, so stale `actions/checkout` credentials cannot break a
+  cold-cache map upload.
 - **Generated CI authenticates map publication explicitly.** `styleproof-init`
   passes the workflow's least-privilege `github.token` as
   `STYLEPROOF_MAP_STORE_TOKEN`, so cold-cache uploads do not depend on private
@@ -19,6 +38,11 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
   directly in `.git/config`; StyleProof now explicitly enables Git config includes
   and falls back to its locally registered checkout config before carrying that
   header into the isolated clone and push.
+- **Map-store uploads now reuse credentials from `actions/checkout@v7`.**
+  Checkout v7 keeps its HTTP header in an included temporary config rather than
+  directly in `.git/config`; StyleProof now explicitly enables Git config includes
+  and falls back to its locally registered checkout config before carrying that
+  header into the isolated clone and push.
 - **Map-store uploads now reuse the HTTP authentication persisted by
   `actions/checkout`.** The isolated `styleproof-maps` clone carries the
   checkout's URL-scoped extra header through clone and push, so cache-miss

package/dist/map-store.js

@@ -64,6 +64,15 @@ function parseGitHttpExtraHeaders(configuredHeaders) {
     });
 }
 function effectiveGitHttpExtraHeaders(cwd) {
+    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
+    if (mapStoreToken) {
+        return [
+            {
+                key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
+                value: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${mapStoreToken}`).toString('base64')}`,
+            },
+        ];
+    }
     const configuredHeaders = runGit(cwd, ['config', '--includes', '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
     const effectiveHeaders = parseGitHttpExtraHeaders(configuredHeaders.stdout);
     if (effectiveHeaders.length > 0)
@@ -82,15 +91,7 @@ function effectiveGitHttpExtraHeaders(cwd) {
     });
     if (includedHeaders.length > 0)
         return includedHeaders;
-    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
-    if (!mapStoreToken)
-        return [];
-    return [
-        {
-            key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
-            value: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${mapStoreToken}`).toString('base64')}`,
-        },
-    ];
+    return [];
 }
 function gitOutput(cwd, args) {
     const r = runGit(cwd, args);
@@ -435,15 +436,27 @@ function copyDir(src, dest, includeHar) {
         filter: (source) => includeHar || !source.endsWith('.har'),
     });
 }
-function checkoutMapStore(cwd, remote, branch) {
+function checkoutSparseSegment(tmp, branch, segment) {
+    const sparseCheckout = runGit(tmp, ['sparse-checkout', 'set', segment], 1 << 20);
+    const checkout = sparseCheckout.status === 0 ? runGit(tmp, ['checkout', '-q', branch], 1 << 20) : sparseCheckout;
+    if (checkout.status !== 0) {
+        fs.rmSync(tmp, { recursive: true, force: true });
+        throw new MapStoreError(checkout.stderr.trim() || `could not check out ${segment} from map store`);
+    }
+}
+function checkoutMapStore(cwd, remote, branch, sparseSegment) {
     if (!remoteExists(remote, cwd))
         throw new MapStoreError(`git remote ${remote} was not found`);
     const remoteUrl = gitOutput(cwd, ['remote', 'get-url', remote]);
     const httpExtraHeaders = effectiveGitHttpExtraHeaders(cwd);
     const authenticationArguments = httpExtraHeaders.flatMap(({ key, value }) => ['-c', `${key}=${value}`]);
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'styleproof-map-store-'));
-    if (runGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20).status === 0) {
-        const clone = spawnSync('git', [...authenticationArguments, 'clone', '-q', '--depth', '1', '--branch', branch, remoteUrl, tmp], {
+    const branchExists = runGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20).status === 0;
+    if (branchExists) {
+        const cloneArguments = sparseSegment
+            ? ['clone', '-q', '--filter=blob:none', '--no-checkout', '--depth', '1', '--single-branch', '--branch', branch]
+            : ['clone', '-q', '--depth', '1', '--branch', branch];
+        const clone = spawnSync('git', [...authenticationArguments, ...cloneArguments, remoteUrl, tmp], {
             encoding: 'utf8',
             maxBuffer: 1 << 20,
             env: gitProcessEnvironment(),
@@ -459,6 +472,8 @@ function checkoutMapStore(cwd, remote, branch) {
     }
     for (const { key, value } of httpExtraHeaders)
         runGit(tmp, ['config', '--local', key, value]);
+    if (sparseSegment && branchExists)
+        checkoutSparseSegment(tmp, branch, sparseSegment);
     return tmp;
 }
 export function publishMapBundle(options) {
@@ -479,7 +494,7 @@ export function publishMapBundle(options) {
     let ok = false;
     let lastError = '';
     for (let attempt = 1; attempt <= 5; attempt++) {
-        const tmp = checkoutMapStore(cwd, remote, branch);
+        const tmp = checkoutMapStore(cwd, remote, branch, sha);
         try {
             runGit(tmp, ['config', 'user.name', 'github-actions[bot]']);
             runGit(tmp, ['config', 'user.email', '41898282+github-actions[bot]@users.noreply.github.com']);
@@ -489,7 +504,7 @@ export function publishMapBundle(options) {
             if (!options.includeHar) {
                 fs.writeFileSync(path.join(tmp, target, MAP_MANIFEST), JSON.stringify({ ...manifest, har: false }, null, 2));
             }
-            runGit(tmp, ['add', '-A']);
+            runGit(tmp, ['add', '-A', '--sparse', '--', 'README.md', target]);
             runGit(tmp, ['commit', '-q', '-m', `StyleProof map ${sha.slice(0, 12)} ${compatibilityKey}`], 1 << 20);
             const push = runGit(tmp, ['push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
             if (push.status === 0) {
@@ -520,7 +535,7 @@ export function restoreMapBundle(options) {
     if (runGit(cwd, ['ls-remote', '--exit-code', '--heads', remote, branch], 1 << 20).status !== 0) {
         throw new MapStoreError(`map store branch ${branch} does not exist`);
     }
-    const tmp = checkoutMapStore(cwd, remote, branch);
+    const tmp = checkoutMapStore(cwd, remote, branch, sha);
     try {
         const shaDir = path.join(tmp, sha);
         if (!fs.existsSync(shaDir))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.7",
+  "version": "4.4.9",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",