Skip to content

[Code scan] Preserve installer failures through toolchain wrapper logging pipelines #7565

Description

@njzjz

This issue is a result of a Codex global repository scan.

Several toolchain wrapper scripts pipe the installer into tee compile.log without enabling pipefail or returning the installer's ${PIPESTATUS[0]}. In Bash, the pipeline exit status is the status of tee, so CI/users can see a successful wrapper exit even when install_abacus_toolchain_new.sh failed.

Example GNU wrapper:

${DRY_RUN_MODE:+$([ "$DRY_RUN_MODE" = "yes" ] && echo "--dry-run")} \
${PACK_RUN_MODE:+$([ "$PACK_RUN_MODE" = "yes" ] && echo "--pack-run")} \
${ENABLE_CUDA:+--enable-cuda} \
${GPU_VERSION:+--gpu-ver="$GPU_VERSION"} \
"$@" \
| tee compile.log

Example Intel wrapper:

${DRY_RUN_MODE:+$([ "$DRY_RUN_MODE" = "yes" ] && echo "--dry-run")} \
${PACK_RUN_MODE:+$([ "$PACK_RUN_MODE" = "yes" ] && echo "--pack-run")} \
${ENABLE_CUDA:+--enable-cuda} \
${GPU_VERSION:+--gpu-ver="$GPU_VERSION"} \
"$@" \
| tee compile.log

The same pattern exists in the GCC/MKL, GCC/AOCL, and AOCC/AOCL wrappers.

Relevant code:

"$@" \
  | tee compile.log

Suggested fix:

Enable set -o pipefail before the pipeline, or explicitly exit ${PIPESTATUS[0]} after tee so wrapper callers receive the installer failure status.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    Status
    In Progress

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions