ci: Use set -eufo pipefail

Most scripts can use it and it is good at catching errors.

Signed-off-by: Demi Marie Obenour <demiobenour@gmail.com>

.github/workflows/dco.yaml

@@ -16,5 +16,6 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
+        set -eufo pipefail
         pip3 install -U dco-check
         dco-check -e "49699333+dependabot[bot]@users.noreply.github.com"

.github/workflows/integration-arm64.yaml

@@ -31,6 +31,7 @@ jobs:
       - name: Install Azure CLI
         if: ${{ github.event_name != 'pull_request' }}
         run: |
+          set -eufo pipefail
           sudo apt install -y ca-certificates curl apt-transport-https lsb-release gnupg
           curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null
           echo "deb [arch=arm64] https://packages.microsoft.com/repos/azure-cli/ bookworm main" | sudo tee /etc/apt/sources.list.d/azure-cli.list
@@ -40,6 +41,7 @@ jobs:
         if: ${{ github.event_name != 'pull_request' }}
         shell: bash
         run: |
+          set -eufo pipefail
           IMG_BASENAME=windows-11-iot-enterprise-aarch64.raw
           IMG_PATH=$HOME/workloads/$IMG_BASENAME
           IMG_GZ_PATH=$HOME/workloads/$IMG_BASENAME.gz

.github/workflows/integration-windows.yaml

@@ -17,6 +17,7 @@ jobs:
       - name: Install Docker
         if: ${{ github.event_name != 'pull_request' }}
         run: |
+          set -eufo pipefail
           sudo apt-get update
           sudo apt-get -y install ca-certificates curl gnupg
           curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
@@ -27,6 +28,7 @@ jobs:
       - name: Install Azure CLI
         if: ${{ github.event_name != 'pull_request' }}
         run: |
+          set -eufo pipefail
           sudo apt install -y ca-certificates curl apt-transport-https lsb-release gnupg
           curl -sL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/microsoft.gpg > /dev/null
           echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ jammy main" | sudo tee /etc/apt/sources.list.d/azure-cli.list
@@ -35,6 +37,7 @@ jobs:
       - name: Download Windows image
         if: ${{ github.event_name != 'pull_request' }}
         run: |
+          set -eufo pipefail
           mkdir $HOME/workloads
           az storage blob download --container-name private-images --file "$HOME/workloads/windows-server-2022-amd64-2.raw" --name windows-server-2022-amd64-2.raw --connection-string "${{ secrets.CH_PRIVATE_IMAGES }}"
       - name: Run Windows guest integration tests

.github/workflows/integration-x86-64.yaml

@@ -23,6 +23,7 @@ jobs:
       - name: Install Docker
         if: ${{ github.event_name != 'pull_request' || (matrix.runner == 'garm-jammy' && matrix.libc == 'gnu') }}
         run: |
+          set -eufo pipefail
           sudo apt-get update
           sudo apt-get -y install ca-certificates curl gnupg
           curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

.github/workflows/lychee.yaml

@@ -20,6 +20,7 @@ jobs:
       # NEW STEP: Print all changed-files outputs for verification
       - name: Verify Changed Files
         run: |
+          set -eufo pipefail
           echo "--- tj-actions/changed-files Outputs ---"
           echo "any_changed: ${{ steps.changed-files.outputs.any_changed }}"
           echo "all_changed_files: ${{ steps.changed-files.outputs.all_changed_files }}"

.github/workflows/mshv-infra.yaml

@@ -59,7 +59,7 @@ jobs:
         env:
           MI_CLIENT_ID: ${{ secrets.MI_CLIENT_ID }}
         run: |
-          set -e
+          set -eufo pipefail
           echo "Installing Azure CLI if not already installed"
           if ! command -v az &>/dev/null; then
             curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
@@ -76,7 +76,7 @@ jobs:
           SKU: ${{ inputs.VM_SKU }}
           STORAGE_ACCOUNT_PATHS: ${{ secrets.STORAGE_ACCOUNT_PATHS }}
         run: |
-          set -e
+          set -eufo pipefail
           # Extract vCPU count from SKU (e.g., "Standard_D2s_v3" => 2)
           vcpu=$(echo "$SKU" | sed -n 's/^Standard_[A-Za-z]\+\([0-9]\+\).*/\1/p')
           if [[ -z "$vcpu" ]]; then
@@ -114,7 +114,7 @@ jobs:
           RG: ${{ inputs.RG }}
           STORAGE_ACCOUNT_PATHS: ${{ secrets.STORAGE_ACCOUNT_PATHS }}
         run: |
-          set -e
+          set -eufo pipefail
           echo "Creating Resource Group: $RG"
           # Create the resource group
           echo "Creating resource group in location: ${LOCATION}"
@@ -127,7 +127,7 @@ jobs:
         env:
           KEY: ${{ inputs.KEY }}
         run: |
-          set -e
+          set -eufo pipefail
           echo "Generating SSH key: $KEY"
           mkdir -p ~/.ssh
           ssh-keygen -t rsa -b 4096 -f ~/.ssh/"${KEY}" -N ""
@@ -145,7 +145,7 @@ jobs:
           VM_IMAGE_NAME: ${{ inputs.ARCH }}_${{ steps.get-location.outputs.location }}_image
           VM_NAME: ${{ inputs.ARCH }}_${{ steps.get-location.outputs.location }}_${{ github.run_id }}
         run: |
-          set -e
+          set -eufo pipefail
           echo "Creating $VM_SKU VM: $VM_NAME"
 
           # Extract subnet ID from the runner VM
@@ -192,7 +192,7 @@ jobs:
           RG: ${{ inputs.RG }}
           VM_NAME: ${{ inputs.ARCH }}_${{ steps.get-location.outputs.location }}_${{ github.run_id }}
         run: |
-          set -e
+          set -eufo pipefail
           echo "Retrieving VM Private IP address..."
           # Retrieve VM Private IP address
           PRIVATE_IP=$(az vm show -g "${RG}" -n "${VM_NAME}" -d --query privateIps -o tsv)
@@ -216,7 +216,7 @@ jobs:
         env:
           PRIVATE_IP: ${{ steps.get-vm-ip.outputs.PRIVATE_IP }}
         run: |
-          set -e
+          set -eufo pipefail
           echo "Removing the old host key"
           ssh-keygen -R "$PRIVATE_IP"
 
@@ -226,9 +226,9 @@ jobs:
           PRIVATE_IP: ${{ steps.get-vm-ip.outputs.PRIVATE_IP }}
           USERNAME: ${{ secrets.USERNAME }}
         run: |
-          set -e
+          set -eufo pipefail
           ssh -i ~/.ssh/"${KEY}" -o StrictHostKeyChecking=no -- "${USERNAME}@${PRIVATE_IP}" << EOF
-            set -e
+            set -eufo pipefail
             echo "Logged in successfully."
             echo "Installing dependencies..."
             sudo tdnf install -y git moby-engine moby-cli clang llvm pkg-config make gcc glibc-devel

.github/workflows/mshv-integration.yaml

@@ -36,7 +36,7 @@ jobs:
           RG: MSHV-${{ github.run_id }}
           USERNAME: ${{ secrets.MSHV_USERNAME }}
         run: |
-          set -e
+          set -eufo pipefail
           echo "Connecting to the VM via SSH..."
           ssh -i ~/.ssh/"${KEY}" -o StrictHostKeyChecking=no -- "${USERNAME}@${PRIVATE_IP}" << EOF
             set -e
@@ -96,7 +96,7 @@ jobs:
           RG_NAME: ${{ needs.infra-setup.outputs.RG_NAME }}
           VM_NAME: ${{ needs.infra-setup.outputs.VM_NAME }}
         run: |
-          set -e
+          set -eufo pipefail
           az vm boot-diagnostics get-boot-log --name "${VM_NAME}" --resource-group "${RG_NAME}" | jq -r
 
   cleanup:

.github/workflows/package-consistency.yaml

@@ -27,6 +27,7 @@ jobs:
 
       - name: Check Rust VMM Package Consistency of fuzz Workspace
         run: |
+          set -eufo pipefail
           pushd fuzz
           python3 ../scripts/package-consistency-check.py github.com/rust-vmm
           popd

.github/workflows/quality.yaml

@@ -44,7 +44,7 @@ jobs:
       - name: Bisectability Check (default features)
         if: ${{ github.event_name == 'pull_request' && matrix.target == 'x86_64-unknown-linux-gnu' }}
         run: |
-          set -e
+          set -eufo pipefail
           commits=$(git rev-list origin/${{ github.base_ref }}..${{ github.sha }})
           for commit in $commits; do git checkout $commit; cargo check --tests --examples --all --target=${{ matrix.target }}; done
           git checkout ${{ github.sha }}