From 3b1d266e6df3a7b9474deecaf22ca6ff694febc3 Mon Sep 17 00:00:00 2001 From: Graham Savage Date: Mon, 27 Jul 2026 11:48:23 +0100 Subject: [PATCH] Fail the Apply step when tf apply fails The Apply step pipes tf apply into tee so the output can be captured for the Kosli attestation. GitHub Actions' default shell on Linux is "bash -e {0}", which sets errexit but not pipefail, so the step's exit status was tee's rather than tf's. A failed apply therefore left the step green, and the job only broke later in "Apply summary" when its grep for "Apply complete!" found nothing - reporting the failure in the wrong place. Setting "shell: bash" explicitly makes Actions use "bash --noprofile --norc -eo pipefail {0}", so a non-zero exit from tf apply now fails the step and the overall job. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/base.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/base.yml b/.github/workflows/base.yml index 72c7e44..97d8186 100644 --- a/.github/workflows/base.yml +++ b/.github/workflows/base.yml @@ -186,6 +186,7 @@ jobs: kosli attest generic --name terraform-plan --attachments /tmp/${{ inputs.environment }}.plan.txt $COMMIT_ARG - name: Apply + shell: bash if: inputs.tf_apply working-directory: ${{ inputs.working_directory }} run: tf apply 2>&1 | tee /tmp/${{ inputs.environment }}.apply.txt