styleproof 4.4.8 → 4.4.10

package/CHANGELOG.md

@@ -7,6 +7,16 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.10] - 2026-07-13
+
+### Fixed
+
+- **Explicit workflow authentication no longer duplicates the checkout header.**
+  StyleProof clears any inherited GitHub HTTP authorization value before adding
+  `STYLEPROOF_MAP_STORE_TOKEN`, preventing GitHub from rejecting cold-cache
+  clones with `Duplicate header: "Authorization"` while retaining explicit-token
+  precedence over stale checkout credentials.
+
 ## [4.4.8] - 2026-07-13
 
 ### Fixed
@@ -24,6 +34,10 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ### Fixed
 
+- **Explicit map-store credentials take precedence over checkout state.** When
+  `STYLEPROOF_MAP_STORE_TOKEN` is set, StyleProof now uses it before inspecting
+  persisted Git headers, so stale `actions/checkout` credentials cannot break a
+  cold-cache map upload.
 - **Generated CI authenticates map publication explicitly.** `styleproof-init`
   passes the workflow's least-privilege `github.token` as
   `STYLEPROOF_MAP_STORE_TOKEN`, so cold-cache uploads do not depend on private

package/dist/map-store.js

@@ -64,6 +64,19 @@ function parseGitHttpExtraHeaders(configuredHeaders) {
     });
 }
 function effectiveGitHttpExtraHeaders(cwd) {
+    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
+    if (mapStoreToken) {
+        return [
+            {
+                key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
+                value: '',
+            },
+            {
+                key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
+                value: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${mapStoreToken}`).toString('base64')}`,
+            },
+        ];
+    }
     const configuredHeaders = runGit(cwd, ['config', '--includes', '--get-regexp', '^http\\..*\\.extraheader$'], 1 << 20);
     const effectiveHeaders = parseGitHttpExtraHeaders(configuredHeaders.stdout);
     if (effectiveHeaders.length > 0)
@@ -82,15 +95,7 @@ function effectiveGitHttpExtraHeaders(cwd) {
     });
     if (includedHeaders.length > 0)
         return includedHeaders;
-    const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
-    if (!mapStoreToken)
-        return [];
-    return [
-        {
-            key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
-            value: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${mapStoreToken}`).toString('base64')}`,
-        },
-    ];
+    return [];
 }
 function gitOutput(cwd, args) {
     const r = runGit(cwd, args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.8",
+  "version": "4.4.10",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",