Stylelint is never executed (not in npm run lint, not in CI) — 235 latent design-token violations

[steilerDev]

Severity: High — found during a deep project review (2026-07-06).

Defect

CLAUDE.md states "Stylelint enforces token usage automatically" — but stylelint is never executed anywhere:

• Root package.json:31-34: npm run lint = eslint . only; stylelint is a separate script nothing invokes.
• .github/workflows/ci.yml runs typecheck, build, tests, E2E — zero references to eslint, stylelint, or prettier. No husky/git hooks exist either.
• Running npx stylelint "client/src/**/*.module.css" today yields 235 errors, 0 warnings (banned rgba(), hex colors, numeric font-weights, z-index literals). The config (.stylelintrc.json) is genuinely strict (color-no-hex: true, function-disallowed-list: [rgb, rgba, hsl, hsla]) — it just never runs. Only 1 disable comment exists in the codebase (styles/print.css:179, justified), so violations aren't being bypassed — they're simply never checked.

Largest violation clusters (for the cleanup)

• 35 hardcoded rgba() values across 11 *.module.css files: photos/PhotoCard.module.css:52-134, photos/PhotoViewer.module.css:94-186, photos/PhotoAnnotator/PhotoAnnotator.module.css:92-96, GanttChart/GanttTooltip.module.css (16×), SubsidyPipelineCard.module.css:71, InvoicePipelineCard.module.css:22,61, documents/LinkedDocumentCard.module.css:69, pages/WorkItemDetailPage/WorkItemDetailPage.module.css:1038
• Numeric font-weight literals pervasive (bulk of the 235)
• photos/PhotoAnnotator/PhotoAnnotator.module.css:43 literal z-index: 1000; diary/SignatureCapture/SignatureCapture.module.css:130 hex #ffffff
• Hardcoded px spacing: photos/PhotoAnnotator/ToolPalette.module.css:68, pages/HouseholdItemDetailPage.module.css:931; inline style={{ marginTop: '0.5rem' }} at pages/HouseholdItemDetailPage.tsx:1393 (inline styles bypass stylelint entirely)

Suggested fix (high leverage)

1. Fix the 235 existing violations (mostly mechanical: map rgba/hex to tokens, font-weight/z-index to tokens).
2. Add stylelint to npm run lint (or chain it) and to the CI Quality Gates so the existing rules actually gate merges.
3. Update CLAUDE.md if enforcement scope changes.

[steilerDev]

[orchestrator] Resolved in PR #1847 (squash-merged to beta). All 370 stylelint violations fixed (the issue's 235 undercounted — its glob missed styles/*.css): rgba/hex → ~20 new extracted tokens, 98 font-weights + all z-index literals tokenized, duplicate selectors removed, clip → clip-path, print.css cleaned. Stylelint is now chained into npm run lint locally AND gates CI via a scoped Static Analysis step (eslint's 8-error debt deliberately deferred to a follow-up before it can be CI-gated). Bonus real bug fixed: six SCSS @extend rules in plain CSS were silently inert — invoice table cells never received their padding. Follow-ups noted: eslint CI gating, Style Guide token documentation, --z-local pattern documentation. Will reach main with the next beta promotion.

[github-actions]

🎉 This issue has been resolved in version 2.13.0-beta.16 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀