Reusable workflow: stylelint job fails org-wide on missing GitHub token for private dep

[rubenvdlinde]

Symptom

Every app using the reusable `quality.yml` workflow sees the stylelint job fail with:

could not read Username for 'https://github.com': Device not configured

The stylelint step is trying to fetch a private dependency over HTTPS without credentials.

Where seen

Discovered in docudesk#249 + docudesk#250 (2026-05-23). Also reproduces on every recent CI run for docudesk#242, and on the failed runs noted in docudesk#247 (sass-loader devDep).

Likely affects every app that uses the org's reusable workflow.

Probable cause

stylelint's installable dependency tree includes a private repo (probably under `ConductionNL` org) referenced by Git URL. The reusable workflow doesn't pass a PAT/token with read access to that repo, so the install step's clone fails.

Suggested fix

In `.github/.github/workflows/quality.yml` (the org reusable workflow), the npm-install steps that resolve stylelint deps need either:

• a checkout/install with `token: ${{ secrets.GH_PACKAGES_READ_PAT }}` (or similar) so git+https URLs auth
• a `.npmrc` with `//npm.pkg.github.com/:_authToken=...` for private GitHub Packages
• OR migrate the private stylelint preset to a public package

Need an org maintainer with access to repo secrets to wire this up.

Acceptance

• Stylelint job goes green across the fleet without per-app workarounds
• Apps that have CSS to lint produce real stylelint results in CI

[rubenvdlinde]

Update — second symptom found

Discovered during the docudesk follow-up sweep (2026-05-23):

The stylelint job actually fails with two distinct symptoms across the fleet:

Symptom A: `could not read Username for 'https://github.com'\` (original issue)

• Apps that resolve stylelint via a private GitHub dep over HTTPS without a token
• Fix: see original issue body (PAT / npmrc / make public)

Symptom B: `sh: 1: stylelint: not found`

• Apps where the `stylelint` CLI itself isn't in `devDependencies` (only `stylelint-webpack-plugin` is)
• Discovered on docudesk: confirmed by the PR #251 agent — same failure on the immediately prior `development` commit
• Fix: add `stylelint` to each affected app's `devDependencies`

Recommended approach

Audit each fleet app's `package.json` for missing `stylelint` direct dep:

```
for app in apps-extra/*/; do
pkg=$app/package.json
[ -f "$pkg" ] || continue
has_lint=$(jq -r '.scripts.lint // .scripts.stylelint // "—"' "$pkg")
has_dep=$(jq -r '.devDependencies.stylelint // "—"' "$pkg")
echo "$(basename $app): script=$has_lint dep=$has_dep"
done
```

For apps with `script` referencing stylelint but `dep` missing → add `stylelint` to devDependencies (match version used by docudesk #250's added sass-loader: check what nc-vue declares).

For apps with the private-repo symptom (A): needs the org-secret fix described above.

May also be worth filing these as two separate issues if scope diverges.