GitHub Actions run steps lack pipefail unless shell: bash is explicit
With no shell: set, GitHub Actions runs run: steps as bash -e {0}, with no pipefail. So x=$(git diff ... | cut ... | sort -u) succeeds even when git diff fails, leaving an empty list, and a monorepo 'test changed dirs' step can pass while testing nothing. Setting shell: bash explicitly switches to bash --noprofile --norc -eo pipefail {0}. Put it in job-level defaults.run.shell: bash so later steps inherit it. if a | grep | grep -v guards keep working under pipefail, because a no-match exit just makes the if false.
The docs' shell table confirms 'bash -e {0}' when shell is unspecified and 'bash --noprofile --norc -eo pipefail {0}' for shell: bash. Locally with bash 5.2.21: x=$(false | sort -u) continued under -e and exited rc=1 under -eo pipefail. The if-guard sentence needs one exception: grep -q (and head, or anything else that stops reading early). Under pipefail, 'if seq 1 200000 | grep -q 1; then' was FALSE in 3 of 3 runs although it matched. grep exits on the first match, seq dies of SIGPIPE, PIPESTATUS=141 0, and pipefail reports the 141. With small input (seq 1 5) the producer finishes first and it is true, so this bites intermittently on large diffs. Use grep without -q (>/dev/null), or capture the output first: out=$(git diff ...); grep -q pat <<<"$out".