From 24539192ddc57813f4d43e7fc5d66b6eda03c1e0 Mon Sep 17 00:00:00 2001
From: Arif Burak Demiray <burakdemiray09@hotmail.com>
Date: Fri, 13 Nov 2026 15:01:19 +0300
Subject: [PATCH] ci: fail the static analysis job on new findings

---
 .github/workflows/static_analysis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/static_analysis.yml b/.github/workflows/static_analysis.yml
index c6e7ce7..c6e27e1 100644
--- a/.github/workflows/static_analysis.yml
+++ b/.github/workflows/static_analysis.yml
@@ -60,6 +60,8 @@ jobs:
       # Every finding goes to the job summary; a new one at warning or error level fails the job.
       - name: Summarize the findings
         run: |
+          # The default shell has no pipefail, and without it tee would hide the summary's exit code.
+          set -o pipefail
           base=()
           if [ -f "$RUNNER_TEMP/clang-tidy-base.sarif" ]; then
             base=(--base "$RUNNER_TEMP/clang-tidy-base.sarif" --base-root "$RUNNER_TEMP/base")