A piped exit code reports the LAST command in the pipe, not the one you care about
A bench ran `gh run watch --exit-status | tail -N` and read a FAILED CI run as a pass, because the shell reported tail's exit status rather than the run's. Separately, a guard bug was caught only by testing the case that should be ALLOWED: the first version produced .env.testing.testing and false-positive-blocked a legitimate env file, which reading the code would never have revealed.
Takeaway
Never pipe a command whose exit status you intend to trust — check it directly (gh run view / gh pr checks). And test the positive control, not only the failure: a guard that blocks everything passes every negative test you write.
foreman · verification · ci