# GitHub Actions pipeline failure hidden without pipefail (custom shell)

> Fix a GitHub Actions run where a failing command in a pipe is ignored - a custom shell without pipefail only checks the last command.

Source: https://latchkey.dev/learn/github-actions/github-actions-shell-pipefail-masks-status  
Updated: 2026-06-26

The default bash shell sets pipefail, so a failing command in a pipe fails the step. Overriding shell (for example shell: bash -e {0} without -o pipefail) drops pipefail and hides upstream failures.

## Diagnose it: print the context before you change anything

Most workflow-expression bugs are not syntax errors, they are an expression reading something that is empty. GitHub resolves a missing property to an empty string instead of failing the run, so a wrong reference looks like a logic bug rather than a mistake. Dump the contexts first and you will usually see the answer immediately.

```.github/workflows/ci.yml
- name: Dump contexts
  run: |
    echo '--- github ---'   ; echo '${{ toJSON(github) }}'
    echo '--- needs ---'    ; echo '${{ toJSON(needs) }}'
    echo '--- steps ---'    ; echo '${{ toJSON(steps) }}'
    echo '--- matrix ---'   ; echo '${{ toJSON(matrix) }}'
    echo '--- inputs ---'   ; echo '${{ toJSON(inputs) }}'
```

> An empty `{}` or a blank line is the finding. It means the context is not populated at that point, which is a different problem from the value being wrong, and it needs a different fix.

## Check the context is allowed where you used it

Contexts are not available everywhere. The same expression can be valid in a step `if` and invalid in a job `if`, which is why an expression that works in one workflow fails when moved.

| Where you wrote it | Contexts available there |
| --- | --- |
| `run-name` | `github`, `inputs`, `vars` |
| `concurrency` | `github`, `inputs`, `vars` |
| Top-level `env` | `github`, `secrets`, `inputs`, `vars` |
| `jobs.<id>.if` | `github`, `needs`, `vars`, `inputs` |
| `jobs.<id>.steps.if` | `github`, `needs`, `strategy`, `matrix`, `job`, `runner`, `env`, `vars`, `steps`, `inputs` |
| `jobs.<id>.outputs` | Full access, including `secrets` |
| Reusable workflow `outputs` | `github`, `jobs`, `vars`, `inputs` |

> The most common trap in this table: `steps` and `matrix` are available in a **step** `if` but not in a **job** `if`. Moving a condition up a level silently breaks it.

## Catch it before it reaches CI

Every failure in this cluster is statically detectable. `actionlint` parses workflow expressions, checks context availability against the same rules above, and validates `needs` references, so these bugs never need to cost you a run.

```Terminal
# one-off
docker run --rm -v "$(pwd):/repo" --workdir /repo rhysd/actionlint:latest -color

# as a job, before anything expensive runs
- uses: actions/checkout@v4
- run: |
    bash <(curl -s https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
    ./actionlint -color
```

## FAQ

### What causes GitHub Actions pipeline failure hidden without pipefail (custom shell)?

There are 2 common causes: custom shell drops pipefail and relying on default but using a different shell. Overriding shell without -o pipefail evaluates only the last command status.

### How do I fix GitHub Actions pipeline failure hidden without pipefail (custom shell)?

Restore pipefail. Use the default bash shell, which already sets pipefail.

### What does GitHub Actions pipeline failure hidden without pipefail (custom shell) actually mean?

A pipeline like cmd1 | cmd2 reports success even though cmd1 failed, because a custom shell setting removed pipefail.

### How do I stop GitHub Actions pipeline failure hidden without pipefail (custom shell) happening again?

Prefer the default shell unless you have a specific reason to override it. The prevention section lists 2 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt