set -e for ctx.actions.run_shell commands (#1360)

* set -e for ctx.actions.run_shall commands

Actions might look like completed successfully even though one of the commands fail.
This might cause remote-cache poisoning.

* Add suggested option in long form

Author: simuons

scala/private/phases/phase_compile.bzl

@@ -261,6 +261,9 @@ def _build_nosrc_jar(ctx):
     zipper_arg_path = ctx.actions.declare_file("%s_zipper_args" % ctx.label.name)
     ctx.actions.write(zipper_arg_path, resources)
     cmd = """
+set -o errexit
+set -o nounset
+set -o pipefail
 rm -f {jar_output}
 {zipper} c {jar_output} @{path}
 # ensures that empty src targets still emit a statsfile and a diagnosticsfile

scala/private/phases/phase_scalafmt.bzl

@@ -53,7 +53,12 @@ def _formatter(ctx, manifest, files, template, output_runner):
         inputs = [template, manifest] + files,
         outputs = [output_runner],
         # replace %workspace% and %manifest% in template and rewrite it to output_runner
-        command = "cat $1 | sed -e s#%workspace%#$2# -e s#%manifest%#$3# > $4",
+        command = """
+set -o errexit
+set -o nounset
+set -o pipefail
+cat $1 | sed -e s#%workspace%#$2# -e s#%manifest%#$3# > $4
+""",
         arguments = [
             template.path,
             ctx.workspace_name,

thrift/thrift.bzl

@@ -77,6 +77,9 @@ def _thrift_library_impl(ctx):
         # We move the files and touch them so that the output file is a purely deterministic
         # product of the _content_ of the inputs
         cmd = """
+set -o errexit
+set -o nounset
+set -o pipefail
 rm -f {out}
 {zipper} c {out} @{path}
 """
@@ -103,6 +106,9 @@ rm -f {out}
             outputs = [ctx.outputs.libarchive],
             mnemonic = "ScalaThriftArchive",
             command = """
+set -o errexit
+set -o nounset
+set -o pipefail
 echo "empty" > {out}.contents
 rm -f {out}
 {zipper} c {out} {out}.contents