How to Use set -euo pipefail in GitHub Actions Scripts

By Daniel Zoghalchali·Latchkey

set -euo pipefail turns silent bugs into loud failures: exit on error, error on unset vars, and fail a pipeline if any stage fails.

Start each multi-line bash step (or your script file) with set -euo pipefail. -e exits on error, -u errors on unset variables, and -o pipefail propagates failures through pipes.

Steps

Put set -euo pipefail as the first line of the script or run block.
Quote variable expansions so word-splitting does not defeat -u.
Use ${VAR:-default} where an unset value is legitimately allowed.

Workflow

.github/workflows/ci.yml

steps:
  - run: |
      set -euo pipefail
      curl -fsSL https://example.com/data.json | jq '.version' > version.txt
      test -s version.txt

Gotchas

GitHub bash already sets -e and pipefail, but not -u; add it yourself to catch typos in variable names.
With -e, a command whose non-zero exit is expected needs || true so it does not abort the step.

Verify it actually works

A workflow that runs is not a workflow that works. Confirm the behaviour on a real event rather than on a manual dispatch, because trigger conditions, permissions, and context values all differ between the two.

Terminal

# 1. validate the file before pushing
docker run --rm -v "$(pwd):/repo" --workdir /repo rhysd/actionlint:latest -color

# 2. trigger the real event, not workflow_dispatch
git commit --allow-empty -m "ci: verify trigger" && git push

# 3. watch it and read the conclusion, not just the colour
gh run watch
gh run view --log-failed

What usually goes wrong first

The workflow file must exist on the default branch before scheduled or dispatch triggers appear at all.
GITHUB_TOKEN permissions default to read-only in many organisations. Declare a permissions: block listing every scope the job needs.
Fork pull requests get a read-only token and no access to secrets, regardless of workflow configuration.
actions/checkout gives you depth 1 on a detached HEAD, so anything needing history or a branch name needs fetch-depth: 0.

Frequently asked questions

How do I use set -euo pipefail in GitHub Actions Scripts?

Start each multi-line bash step (or your script file) with set -euo pipefail. -e exits on error, -u errors on unset variables, and -o pipefail propagates failures through pipes.

References

GitHub Actions documentation