Recommended CI workflow

Generate and publish the report from a trusted CI workspace:

stigPublishHtml depends on the report pipeline. Enabled specification import generates Kotlin before compilation; enabled harness generation supplies temporary C++ and headers directly to P5. Both generators share the compiled interface inventory and write under build/. The normal build performs no source-file synchronization or source Git transaction. See STIG workflows for the command contract.

stigGenerateHtml and stigPublishHtml are read-only with respect to source repositories. Their shared pipeline-start gate rejects any dirty configured Git worktree before compilation, analysis, Dokka preparation, or publication work. stigPublishHtml checks again immediately before creating the Pages commit. There is no dirty-source bypass.

For a report without publication, run ./gradlew :stigGenerateHtml. Run explicit configuration edits in a separate invocation before either report command, review the source changes, and use the normal branch/merge-request workflow.

Set the consumer's explicit report version before publishing. Use the exact uppercase -SNAPSHOT suffix while working toward a release, then remove it deliberately for the release:

Normal publication keeps every release and only the current snapshot. The current report is served at the configured Pages subtree root, and Dokka provides version navigation to retained releases under versions/<full-version>/. For the first migration from the legacy latest/commit layout, choose the real report version and run:

Do not infer a consumer report version from the STIG tool version. The migration prune is scoped to the configured Pages subtree. Every publication preserves the rest of the current Pages tree, writes the result as one parentless commit, and uses an exact force-with-lease to replace the branch. Configure the remote branch to permit force updates for the publishing identity.