Skip to content

pipeline: execute them with set -eo pipefail#2423

Merged
aborrero merged 1 commit intochainguard-dev:mainfrom
aborrero:arturo-24694-pipeline-execute
Mar 18, 2026
Merged

pipeline: execute them with set -eo pipefail#2423
aborrero merged 1 commit intochainguard-dev:mainfrom
aborrero:arturo-24694-pipeline-execute

Conversation

@aborrero
Copy link
Copy Markdown
Contributor

@aborrero aborrero commented Mar 16, 2026

If a pipeline is 'cmd1 | cmd2' we want to fail the execution if cmd1 failed.

Previous to this patch, we had a raising number of pipelines that are manually encoding
'set -eo pipefail' on each instance.

Signed-off-by: Arturo Borrero Gonzalez arturo.borrero@chainguard.dev

@aborrero aborrero force-pushed the arturo-24694-pipeline-execute branch from 92e0cf0 to 7895b36 Compare March 16, 2026 09:44
@markusboehme
Copy link
Copy Markdown
Member

markusboehme commented Mar 16, 2026

Enabling the pipefail and nounset/-u options can cause unintended failures in scripts that written withwere written without them in mind. Aside from catching genuine mistakes, where arguably the package is already broken today and the build just carries on, this looks like a breaking change for packages with unintended failures. Could this be enabled with a feature gate on Melange or a package YAML instead? The failed package builds in CI indicate some pain ahead regardless of genuine mistake or unintended failure.

If a pipeline is 'cmd1 | cmd2' we want to fail the execution if cmd1 failed.

Previous to this patch, we had a raising number of pipelines that are manually encoding
'set -eo pipefail' on each instance.

Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero@chainguard.dev>
@aborrero aborrero force-pushed the arturo-24694-pipeline-execute branch from 7895b36 to 825e17f Compare March 16, 2026 10:19
@aborrero
Copy link
Copy Markdown
Contributor Author

I think the most invasive change is set -u, so I have deleted it from the patch.

@aborrero aborrero changed the title pipeline: execute them with set -euo pipefail pipeline: execute them with set -eo pipefail Mar 16, 2026
Comment thread pkg/build/pipeline.go
Comment on lines +184 to +187
xFlag := ""
if debugOption == 'x' {
xFlag = "x"
}
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: I think a better change would be to remove debugOption rune from the function signature and replace it with something like enableTracing bool. Call sites don't have to know about x/-xtrace.

Comment thread pkg/build/pipeline.go
script := fmt.Sprintf(`set -e%c
xFlag := ""
if debugOption == 'x' {
xFlag = "x"
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is going to cause a lot of spam we don't need an debugs run with -x? Why would we enabled it for all pipelines? @smoser didn't we disable this behavior in the past?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previous to this patch we were already enabling -x for pipelines in debug mode no? the behavior should be unchanged in this patch.

Copy link
Copy Markdown
Contributor

@smoser smoser Apr 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just seeing this now. I do find set -x an anti-pattern. it makes the output of better tests, that provide reasonable output all of a sudden unreadable. but, as aborrero pointed out, it already was.

@aborrero aborrero merged commit 967c2b9 into chainguard-dev:main Mar 18, 2026
60 checks passed
@smoser
Copy link
Copy Markdown
Contributor

smoser commented Apr 13, 2026

@aborrero ,
this caused some passing tests to fail.
#2478

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants