nixos/test-driver: Run commands with error handling

Bash's standard behavior of not propagating non-zero exit codes
through a pipeline is unexpected and almost universally
unwanted. Default to setting `pipefail` for the command being run;
it can still be turned off by prefixing the pipeline with
`set +o pipefail` if needed.

Also, set `errexit` and `nonunset` options to make the first command
of consecutive commands separated by `;` fail, and disallow
dereferencing unset variables respectively.

4 files changed, 30 insertions, 9 deletions

diff --git a/nixos/doc/manual/development/writing-nixos-tests.xml b/nixos/doc/manual/development/writing-nixos-tests.xml
index 32321deeddf9..e372c66410de 100644
--- a/nixos/doc/manual/development/writing-nixos-tests.xml
+++ b/nixos/doc/manual/development/writing-nixos-tests.xml
@@ -274,8 +274,29 @@ start_all()
     </term>
     <listitem>
      <para>
-      Execute a shell command, raising an exception if the exit status is not
-      zero, otherwise returning the standard output.
+      Execute a shell command, raising an exception if the exit status
+      is not zero, otherwise returning the standard output. Commands
+      are run with <literal>set -euo pipefail</literal> set:
+      <itemizedlist>
+        <listitem>
+          <para>
+            If several commands are separated by <literal>;</literal>
+            and one fails, the command as a whole will fail.
+          </para>
+        </listitem>
+        <listitem>
+          <para>
+            For pipelines, the last non-zero exit status will be
+            returned (if there is one, zero will be returned
+            otherwise).
+          </para>
+        </listitem>
+        <listitem>
+          <para>
+            Dereferencing unset variables fail the command.
+          </para>
+        </listitem>
+      </itemizedlist>
      </para>
     </listitem>
    </varlistentry>
diff --git a/nixos/lib/test-driver/test-driver.py b/nixos/lib/test-driver/test-driver.py
index e0e8b0fb71f4..ab739ce3222f 100644
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@@ -441,7 +441,7 @@ class Machine:
     def execute(self, command: str) -> Tuple[int, str]:
         self.connect()
 
-        out_command = "( {} ); echo '|!=EOF' $?\n".format(command)
+        out_command = "( set -euo pipefail; {} ); echo '|!=EOF' $?\n".format(command)
         self.shell.send(out_command.encode())
 
         output = ""
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index 831ef2fb77ad..4c3c26980aa2 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -23,15 +23,15 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     with subtest("includeStorePath"):
         with subtest("assumption"):
             docker.succeed("${examples.helloOnRoot} | docker load")
-            docker.succeed("set -euo pipefail; docker run --rm hello | grep -i hello")
+            docker.succeed("docker run --rm hello | grep -i hello")
             docker.succeed("docker image rm hello:latest")
         with subtest("includeStorePath = false; breaks example"):
             docker.succeed("${examples.helloOnRootNoStore} | docker load")
-            docker.fail("set -euo pipefail; docker run --rm hello | grep -i hello")
+            docker.fail("docker run --rm hello | grep -i hello")
             docker.succeed("docker image rm hello:latest")
         with subtest("includeStorePath = false; works with mounted store"):
             docker.succeed("${examples.helloOnRootNoStore} | docker load")
-            docker.succeed("set -euo pipefail; docker run --rm --volume ${builtins.storeDir}:${builtins.storeDir}:ro hello | grep -i hello")
+            docker.succeed("docker run --rm --volume ${builtins.storeDir}:${builtins.storeDir}:ro hello | grep -i hello")
             docker.succeed("docker image rm hello:latest")
 
     with subtest("Ensure Docker images use a stable date by default"):
diff --git a/nixos/tests/wiki-js.nix b/nixos/tests/wiki-js.nix
index 9aa87d15366b..783887d2dcaa 100644
--- a/nixos/tests/wiki-js.nix
+++ b/nixos/tests/wiki-js.nix
@@ -119,7 +119,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
 
     with subtest("Setup"):
         result = machine.succeed(
-            "set -o pipefail; curl -sSf localhost:3000/finalize -X POST -d "
+            "curl -sSf localhost:3000/finalize -X POST -d "
             + "@${payloads.finalize} -H 'Content-Type: application/json' "
             + "| jq .ok | xargs echo"
         )
@@ -132,7 +132,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
 
     with subtest("Base functionality"):
         auth = machine.succeed(
-            "set -o pipefail; curl -sSf localhost:3000/graphql -X POST "
+            "curl -sSf localhost:3000/graphql -X POST "
             + "-d @${payloads.login} -H 'Content-Type: application/json' "
             + "| jq '.[0].data.authentication.login.jwt' | xargs echo"
         ).strip()
@@ -140,7 +140,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
         assert auth
 
         create = machine.succeed(
-            "set -o pipefail; curl -sSf localhost:3000/graphql -X POST "
+            "curl -sSf localhost:3000/graphql -X POST "
             + "-d @${payloads.content} -H 'Content-Type: application/json' "
             + f"-H 'Authorization: Bearer {auth}' "
             + "| jq '.[0].data.pages.create.responseResult.succeeded'|xargs echo"