I use diff-cover to produce an HTML report about missing test coverage for GitHub pull requests, and I use the HTML Publisher plugin to publish that reports.

My problem: all inline CSS in the HTML report produced by diff-cover is ignored. Instead of seeing uncovered code lines highlighted in red I see this:

The Chrome Developer Tools shows this error in the console:

> Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-38w8qtDewK1eDzv93gUtrP2TU2U9nk/1k3yxhYDPDU0='), or a nonce ('nonce-...') is required to enable inline execution.

(There's also an error about blocked script execution, but that seems unrelated.)