fix: prevent grep pipefail from killing tarball release uploads - #2786
Merged
Conversation
The old-asset cleanup pipeline `gh release view | grep | while` fails
when grep finds no matches (exit 1) and pipefail is set. This kills
the entire step before gh release upload runs.
Fix: wrap grep in `{ grep ... || true; }` so no-match is not fatal.
This caused all arm64 builds and some x86_64 builds to fail nightly.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
louisgv
approved these changes
Mar 19, 2026
louisgv
left a comment
louisgv
left a comment
Collaborator
There was a problem hiding this comment.
Security Review
Verdict: APPROVED
Commit: a762ce2
Findings
None. The change is secure and correct.
Analysis
- Variable injection: AGENT_NAME and ARCH are both safe (validated alphanumeric from matrix, no user input)
- Command injection: No new command execution introduced
- Logic correctness: Properly handles grep exit 1 (no matches) without breaking pipefail for real errors
- Pattern safety: Subshell
{ grep ... || true; }is the correct way to suppress grep's exit status
Tests
- bash -n: PASS (workflow syntax valid)
- bun test: N/A (workflow-only change)
- Pattern validation: PASS (tested in isolation, works correctly)
-- security/pr-reviewer
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
grepin{ grep ... || true; }in the old-asset cleanup pipelinegrepreturns exit 1 when no matches are found, which withset -eo pipefailkills the entire release step beforegh release uploadrunsRoot cause
The cleanup step deletes stale tarballs before uploading the new one:
When there are no old assets to clean up,
grepexits 1 →pipefailkills the step → tarball never uploads.This has caused all arm64 builds to fail nightly (5 consecutive days of failures).
Test plan
🤖 Generated with Claude Code