Add STIG hrdening

.gitea/workflows/gitea-main-ci.yaml

@@ -59,6 +59,10 @@ env:
   # ship the graphical splash once boot is trusted. (Plymouth is in the image
   # either way; this only flips the cmdline.)
   BOOT_SPLASH: "true"
+  # DISA STIG hardening (OpenSCAP + SSG, diskless/UKI/kiosk tailoring). Report-only
+  # in CI: the scan + deviations report are published as artifacts; the build is
+  # never failed on score. Set "false" to skip hardening (boot/secure-path bench).
+  ENABLE_STIG: "true"
   # ===========================================================================
   # TEMPORARY: 802.1X + MACsec are DISABLED for this build (rd.dot1x=0) so the
   # UKI / rootfs / NVMe-oF boot path can be validated on an OPEN switch port.
@@ -187,4 +191,33 @@ jobs:
             -var ssh_authorized_key="${{ secrets.SSH_AUTHORIZED_KEY }}" \
             -var kiosk_url="${{ env.KIOSK_URL }}" \
             -var boot_splash=${{ env.BOOT_SPLASH }} \
+            -var enable_stig=${{ env.ENABLE_STIG }} \
             .
+
+      -
+        name: STIG deviations report (report-only)
+        # The build downloaded the post-remediation scan (stig-arf.xml +
+        # stig-report.html) into artifacts/<version>/. Turn the ARF into a
+        # readable deviations report. Never fails the build (report-only).
+        if: ${{ env.ENABLE_STIG == 'true' }}
+        run: |
+          dir="artifacts/${{ steps.vars.outputs.image_version }}"
+          if [ -s "$dir/stig-arf.xml" ]; then
+            bash scripts/stig-deviations.sh "$dir/stig-arf.xml" "$dir/stig-deviations.md" || true
+            echo "----- STIG deviations (summary) -----"
+            sed -n '1,40p' "$dir/stig-deviations.md" || true
+          else
+            echo "no STIG ARF found (enable_stig off or scan failed) — skipping report"
+          fi
+
+      -
+        name: Publish STIG report artifacts
+        if: ${{ env.ENABLE_STIG == 'true' }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: stig-report-${{ steps.vars.outputs.image_version }}
+          path: |
+            artifacts/${{ steps.vars.outputs.image_version }}/stig-report.html
+            artifacts/${{ steps.vars.outputs.image_version }}/stig-arf.xml
+            artifacts/${{ steps.vars.outputs.image_version }}/stig-deviations.md
+          if-no-files-found: warn