From 00f3e74e1c0bdfe06bef82a3e334a17ec018955b Mon Sep 17 00:00:00 2001
From: John Safranek <john@wolfssl.com>
Date: Fri, 30 Oct 2026 15:29:30 -0700
Subject: [PATCH] Fail the cppcheck job on a finding

The cppcheck step pipes through tee, so its exit code was lost and the
job passed with findings. Run the step under bash, which sets pipefail,
and upload the results file only when the step fails.
---
 .github/workflows/cppcheck.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index c728a6b6..b9091057 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -24,6 +24,8 @@ jobs:
       - name: Run CppCheck
         id: cpp_check_run
         if: always()
+        # bash gets -o pipefail, so tee keeps cppcheck's exit code
+        shell: bash
         run: >
           cppcheck
           -UWSCPFILEHDR -UXSNPRINTF
@@ -41,7 +43,7 @@ jobs:
           3>&1 1>&2 2>&3 | tee cppcheck.txt
 
       - name: Upload cppcheck results as artifact
-        if: always()
+        if: failure() && steps.cpp_check_run.outcome == 'failure'
         uses: actions/upload-artifact@v7
         with:
           name: wolfssh-${{ github.sha }}-cppcheck_results.txt