CI: run bash with '-euo pipefail' (#11375)

Author: emilk

.github/actions/setup-rust/action.yml

@@ -44,14 +44,14 @@ runs:
       if: ${{ runner.os == 'macOS' }}
       run: |
         echo "$(brew --prefix llvm@18)/bin" >> $GITHUB_PATH
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
 
     - name: Check clang version
       if: ${{ runner.os == 'macOS' }}
       run: |
         clang --version
         which clang
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
 
     - name: Set up GCP credentials
       uses: google-github-actions/auth@v2
@@ -60,7 +60,7 @@ runs:
         service_account: ${{ inputs.service_account }}
 
     - name: Ensure correct version of Rust is installed
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       run: |
         # This is the only way to force rustup to install the version of Rust
         # and the components/targets specified in our `rust-toolchain` file.
@@ -69,12 +69,12 @@ runs:
 
     - name: Install additional targets
       if: ${{ inputs.targets != '' }}
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       run: rustup target add ${{ inputs.targets }}
 
     - name: Install additional toolchains
       if: ${{ inputs.toolchains }}
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       run: |
         for toolchain in ${{ inputs.toolchains }}; do
           rustup install $toolchain
@@ -89,7 +89,7 @@ runs:
         gcs_read_only: false
 
     - name: Verify sccache
-      shell: bash
+      shell: bash --noprofile --norc -euo pipefail {0}
       run: |
         sccache --show-stats
 

.github/workflows/adhoc_wheels.yml

@@ -14,7 +14,7 @@ on:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 permissions:
   contents: "write"

.github/workflows/auto_approve.yml

@@ -7,7 +7,7 @@ on:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 permissions:
   contents: "read"

.github/workflows/auto_docs.yml

@@ -10,7 +10,7 @@ permissions:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 # The lack of `concurrency` is intentional.
 # We want this job to run on every commit, even if multiple are merged in a row.

.github/workflows/auto_docs_check.yml

@@ -16,7 +16,7 @@ permissions:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 concurrency:
   group: pr-${{ github.event.pull_request.number }}-auto-docs-check

.github/workflows/checkboxes.yml

@@ -16,7 +16,7 @@ concurrency:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 permissions:
   contents: "read"

.github/workflows/contrib_checks.yml

@@ -36,7 +36,7 @@ env:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 permissions:
   contents: "read"
@@ -70,7 +70,6 @@ jobs:
           environments: py-docs
 
       - name: Build via mkdocs
-        shell: bash
         run: |
           pixi run -e py-docs mkdocs build --strict -f rerun_py/mkdocs.yml
 

.github/workflows/contrib_rerun_py.yml

@@ -30,7 +30,7 @@ env:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 permissions:
   contents: "read"

.github/workflows/nightly.yml

@@ -9,7 +9,7 @@ on:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 permissions:
   contents: "write"

.github/workflows/on_gh_release.yml

@@ -19,7 +19,7 @@ concurrency:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -euo pipefail {0}
 
 permissions:
   # required for updating the release