From 1280dfcdbb81461aeba4fb12b3db5c0c51db894e Mon Sep 17 00:00:00 2001
From: 0thernet <benzguo@gmail.com>
Date: Sun, 4 Oct 2026 18:55:02 -0400
Subject: [PATCH] Fail the coverage check when a repository lacks the audit

The step pipes the report through tee. GitHub's default run shell is
bash -e without pipefail, so the job passed even when the script
reported qmd missing and exited 1. An explicit shell: bash runs with
-eo pipefail.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 .github/workflows/dependency-audit-coverage.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/dependency-audit-coverage.yml b/.github/workflows/dependency-audit-coverage.yml
index 90f5c64..d2222a6 100644
--- a/.github/workflows/dependency-audit-coverage.yml
+++ b/.github/workflows/dependency-audit-coverage.yml
@@ -22,6 +22,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check public repositories
+        shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
         run: python3 scripts/sync-dependency-audit.py --check --org hraness --visibility public --include-forks | tee -a "$GITHUB_STEP_SUMMARY"