From b54b50da24d1d4ee8cb086a1bfe45cff172c547c Mon Sep 17 00:00:00 2001
From: Arif Burak Demiray <burakdemiray09@hotmail.com>
Date: Fri, 13 Nov 2026 15:01:29 +0300
Subject: [PATCH] ci: fail the static analysis job on new findings

---
 .github/workflows/static_analysis.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/static_analysis.yml b/.github/workflows/static_analysis.yml
index 4f33d6aa..d65e590a 100644
--- a/.github/workflows/static_analysis.yml
+++ b/.github/workflows/static_analysis.yml
@@ -57,6 +57,8 @@ jobs:
       # Every finding goes to the job summary; a new one at warning or error level fails the job.
       - name: Summarize the findings
         run: |
+          # The default shell has no pipefail, and without it tee would hide the summary's exit code.
+          set -o pipefail
           base=()
           if [ -d "$RUNNER_TEMP/sarif-base" ]; then
             base=(--base "$RUNNER_TEMP/sarif-base" --base-root "$RUNNER_TEMP/base")