Skip to main content

​
What the check does

Flags a multi-command bash run: block (GitHub Actions) or a multi-command script: (GitLab CI) that does not enable strict mode.

​
Why it matters

GitHub’s default shell for a run: step on Linux and macOS is bash -e — one of the three flags that matter, and not the interesting one: Without pipefail, this step passes green when generate crashes, because the step’s exit status is tee’s:
Without -u, a misspelled or unset variable expands to the empty string:
Both fail silently, and both produce a build that looks like it worked. GitLab has the same gap — the runner sets -e per script, not pipefail.

​
Safe alternative

Or set it on the step’s shell, which is equivalent:
On GitLab, once in a top-level default: covers every job:

​
What does not fire

Scoped tightly on purpose — this pattern is everywhere, and a rule that fires on all of it is a rule people turn off:

​
Persona and rulesets

This rule is tiered to the pedantic persona. It is a real gap, not a stylistic preference, but it fires on ordinary CI and must not crowd out security findings at the default tier:
It carries no framework tags — it is resilience hygiene, like missing timeout and missing concurrency — so it appears under the all ruleset and not under owasp or slsa.

​
Auto-fix

Prepends set -euo pipefail — after a shebang when the script has one, because a shebang only works on line 1 and inserting above it would silently change which interpreter runs the script. The inserted line matches the script’s own indentation. On GitLab the line becomes the first script: entry.