ci: Codex login steps run under bash (the CI container's default sh rejects pipefail)

.github/workflows/evals-marathon.yml

@@ -179,6 +179,7 @@ jobs:
       # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
       # Codex, as before. Without a key the Codex cases fail; they never pass.
       - name: Authenticate the Codex CLI
+        shell: bash
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

.github/workflows/evals-periodic.yml

@@ -213,6 +213,7 @@ jobs:
       # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
       # Codex, as before. Without a key the Codex cases fail; they never pass.
       - name: Authenticate the Codex CLI
+        shell: bash
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -336,6 +337,7 @@ jobs:
       # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
       # Codex, as before. Without a key the Codex cases fail; they never pass.
       - name: Authenticate the Codex CLI
+        shell: bash
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

.github/workflows/evals.yml

@@ -281,6 +281,7 @@ jobs:
       # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
       # Codex, as before. Without a key the Codex cases fail; they never pass.
       - name: Authenticate the Codex CLI
+        shell: bash
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

test/codex-ci-access.test.ts

@@ -149,7 +149,13 @@ describe('codex CI access in the image and workflows', () => {
     for (const name of ['evals.yml', 'evals-periodic.yml', 'evals-marathon.yml']) {
       const workflow = Bun.YAML.parse(fs.readFileSync(path.join(ROOT, '.github/workflows', name), 'utf8')) as any;
       for (const job of Object.values<any>(workflow.jobs)) {
-        for (const step of job.steps ?? []) if (/login --with-api-key/.test(String(step.run ?? ''))) steps.push(String(step.run));
+        for (const step of job.steps ?? []) {
+          if (!/login --with-api-key/.test(String(step.run ?? ''))) continue;
+          steps.push(String(step.run));
+          // The paid jobs run inside the CI container whose default shell is `sh -e` (dash),
+          // which rejects `set -o pipefail`; the login step must opt into bash.
+          if (/pipefail/.test(String(step.run))) expect({ step: step.name, shell: step.shell }).toEqual({ step: step.name, shell: 'bash' });
+        }
       }
     }
     expect(steps.length).toBeGreaterThanOrEqual(4);