ci: Fix check-changed error code (#2966)

Errors weren't being bubbled up from subshells to the parent script.
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

.circleci/config.yml

@@ -14,6 +14,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(check-changed "packages/")
             if [[ "$CHANGED" = "FALSE" ]]; then
               circleci step halt
@@ -115,6 +116,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(check-changed "(contracts-bedrock|hardhat-deploy-config)")
             if [[ "$CHANGED" = "FALSE" ]]; then
               circleci step halt
@@ -166,6 +168,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(check-changed "(packages/<<parameters.package_name>>|packages/<<parameters.dependencies>>)")
             if [[ "$CHANGED" = "FALSE" ]]; then
               circleci step halt
@@ -187,6 +190,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(check-changed "op-(batcher|bindings|e2e|node|proposer)")
             if [[ "$CHANGED" = "FALSE" ]]; then
               circleci step halt
@@ -266,6 +270,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(check-changed "op-node")
             if [[ "$CHANGED" = "FALSE" ]]; then
               circleci step halt
@@ -286,6 +291,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(check-changed "packages/")
             if [[ "$CHANGED" = "FALSE" ]]; then
               circleci step halt
@@ -341,6 +347,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(check-changed "(<<parameters.working_directory>>|<<parameters.dependencies>>)")
             echo $CHANGED
             if [[ "$CHANGED" = "FALSE" ]]; then
@@ -375,6 +382,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(check-changed "l2geth")
             if [[ "$CHANGED" = "FALSE" ]]; then
               circleci step halt
@@ -441,6 +449,7 @@ jobs:
       - run:
           name: Check if we should run
           command: |
+            shopt -s inherit_errexit
             CHANGED=$(bash ./ops/docker/ci-builder/check-changed.sh "(l2geth|common-ts|contracts|core-utils|message-relayer|data-transport-layer|replica-healthcheck|sdk|batch-submitter|gas-oracle|bss-core|integration-tests)/")
             if [[ "$CHANGED" = "FALSE" ]]; then
               circleci step halt

ops/docker/ci-builder/check-changed.sh

-#!/usr/bin/env bash
+#!/usr/bin/env -S bash -euET -o pipefail -O inherit_errexit
 
 # Usage: check-changed.sh <diff-pattern>.
 #
@@ -6,8 +6,6 @@
 # and writes TRUE or FALSE to stdout if the diff matches/does not match. It is
 # used by CircleCI jobs to determine if they need to run.
 
-set -e
-
 echoerr() { echo "$@" 1>&2; }
 
 # Check if this is a CircleCI PR.
@@ -27,9 +25,11 @@ if [[ -n $CIRCLE_PULL_REQUEST ]]; then
 	echoerr "Base Ref SHA: $(git show-branch --sha1-name "$REF")"
  	echoerr "Curr Ref:     $(git rev-parse --short HEAD)"
 
+ 	DIFF=$(git diff --dirstat=files,0 "$REF...HEAD")
+
  	# Compare HEAD to the PR's base ref, stripping out the change percentages that come with git diff --dirstat.
  	# Pass in the diff pattern to grep, and echo TRUE if there's a match. False otherwise.
- 	(git diff --dirstat=files,0 "$REF...HEAD" | sed 's/^[ 0-9.]\+% //g' | grep -q -E "$PACKAGE" && echo "TRUE") || echo "FALSE"
+ 	(echo "$DIFF" | sed 's/^[ 0-9.]\+% //g' | grep -q -E "$PACKAGE" && echo "TRUE") || echo "FALSE"
 else
 	# Non-PR builds always require a rebuild.
 	echoerr "Not a PR build, requiring a total rebuild."