From c3badab004b3d7c32f3b08a9328c2147bb67a79c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20Gonz=C3=A1lez=20Di=20Antonio?= Date: Sun, 18 Oct 2026 10:51:59 +0200 Subject: [PATCH] ci: a failing step fails the job Every step runs with "shell: bash", which GitHub runs with pipefail. A step that names no shell runs as "bash -e" without it, so "go test ... | tee" and the coverage check piped through sed and tee took tee's status: a failing test or a coverage below its threshold passed the job. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr.yaml | 9 +++++++++ .github/workflows/release.yml | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 3d0e3fa..52073b6 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -14,6 +14,15 @@ env: permissions: contents: read +# Every step runs with "shell: bash", which GitHub runs as +# "bash --noprofile --norc -eo pipefail {0}". The default for a step that +# names no shell is "bash -e {0}", without pipefail: "go test ... | tee" +# and "go-test-coverage ... | sed ... | tee" took tee's status, so a failing +# test or a coverage below its threshold passed the job. +defaults: + run: + shell: bash + jobs: build: runs-on: ubuntu-latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c903acb..9ec7feb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,6 +12,15 @@ permissions: pull-requests: write id-token: write +# Every step runs with "shell: bash", which GitHub runs as +# "bash --noprofile --norc -eo pipefail {0}". The default for a step that +# names no shell is "bash -e {0}", without pipefail: "go test ... | tee" +# and "go-test-coverage ... | sed ... | tee" took tee's status, so a failing +# test or a coverage below its threshold passed the job. +defaults: + run: + shell: bash + jobs: release: name: Release