styleproof 4.4.9 → 4.4.11

package/CHANGELOG.md

@@ -7,6 +7,25 @@ this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased]
 
+## [4.4.11] - 2026-07-13
+
+### Fixed
+
+- **Map-store pushes now receive workflow authentication directly.** The final
+  `git push` uses the same explicit reset-and-token arguments as the isolated
+  clone, so temporary sparse-checkout config cannot drop the Actions token after
+  a successful cold-cache capture.
+
+## [4.4.10] - 2026-07-13
+
+### Fixed
+
+- **Explicit workflow authentication no longer duplicates the checkout header.**
+  StyleProof clears any inherited GitHub HTTP authorization value before adding
+  `STYLEPROOF_MAP_STORE_TOKEN`, preventing GitHub from rejecting cold-cache
+  clones with `Duplicate header: "Authorization"` while retaining explicit-token
+  precedence over stale checkout credentials.
+
 ## [4.4.8] - 2026-07-13
 
 ### Fixed

package/dist/map-store.js

@@ -67,6 +67,10 @@ function effectiveGitHttpExtraHeaders(cwd) {
     const mapStoreToken = process.env.STYLEPROOF_MAP_STORE_TOKEN;
     if (mapStoreToken) {
         return [
+            {
+                key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
+                value: '',
+            },
             {
                 key: ['http.https:', '', 'github.com', '.extraheader'].join('/'),
                 value: `AUTHORIZATION: basic ${Buffer.from(`x-access-token:${mapStoreToken}`).toString('base64')}`,
@@ -491,6 +495,10 @@ export function publishMapBundle(options) {
     const sha = safeSegment(manifest.sha, 'sha');
     const compatibilityKey = safeSegment(manifest.compatibilityKey, 'compatibility key');
     const target = `${sha}/${compatibilityKey}`;
+    const pushAuthenticationArguments = effectiveGitHttpExtraHeaders(cwd).flatMap(({ key, value }) => [
+        '-c',
+        `${key}=${value}`,
+    ]);
     let ok = false;
     let lastError = '';
     for (let attempt = 1; attempt <= 5; attempt++) {
@@ -506,7 +514,7 @@ export function publishMapBundle(options) {
             }
             runGit(tmp, ['add', '-A', '--sparse', '--', 'README.md', target]);
             runGit(tmp, ['commit', '-q', '-m', `StyleProof map ${sha.slice(0, 12)} ${compatibilityKey}`], 1 << 20);
-            const push = runGit(tmp, ['push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
+            const push = runGit(tmp, [...pushAuthenticationArguments, 'push', '-q', 'origin', `HEAD:${branch}`], 1 << 20);
             if (push.status === 0) {
                 ok = true;
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "styleproof",
-  "version": "4.4.9",
+  "version": "4.4.11",
   "description": "Catch every CSS change before it ships — review PRs and certify refactors by the browser's computed styles, not pixels. Works with any styling system.",
   "keywords": [
     "playwright",