[codex] Fix action pipeline failure handling

action.yml

@@ -36,6 +36,7 @@ runs:
       id: check
       shell: bash
       run: |
+        set -o pipefail
         report_file="$RUNNER_TEMP/context-drift-report.${{ inputs.format }}"
         node "$GITHUB_ACTION_PATH/dist/index.js" check \
           --base "${{ inputs.base-ref }}" \

openspec/specs/github-action/spec.md

@@ -15,6 +15,11 @@ The repository SHALL include `action.yml` defining a composite action that insta
 - **WHEN** the action is invoked in a workflow with a checked-out repository
 - **THEN** it SHALL run the CLI from the action path against `github.workspace`
 
+#### Scenario: CLI failures fail the action step
+
+- **WHEN** the CLI exits with a non-zero status while writing the report through `tee`
+- **THEN** the action step SHALL fail with the CLI status
+
 ### Requirement: Support action inputs
 
 The action SHALL expose inputs for base ref, minimum confidence, and output format.

tests/action.test.ts

@@ -0,0 +1,15 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+
+describe("GitHub Action", () => {
+  it("preserves the CLI exit code when tee writes the report", async () => {
+    const action = await fs.readFile(path.join(process.cwd(), "action.yml"), "utf8");
+    const pipefailIndex = action.indexOf("set -o pipefail");
+    const teePipelineIndex = action.indexOf('| tee "$report_file"');
+
+    expect(pipefailIndex).toBeGreaterThanOrEqual(0);
+    expect(teePipelineIndex).toBeGreaterThanOrEqual(0);
+    expect(pipefailIndex).toBeLessThan(teePipelineIndex);
+  });
+});