Use strict, non-silent error handling and evidence gating across CI scripts and publish steps—especially when untrusted inputs and reruns are involved. Apply these rules: 1) Never hide failing diagnostics - Don’t redirect critical command errors to `/dev/null` without capturing them into logs. - If you must suppress, replace it with a structured warning including the failing command and exit code. 2) Make “no match/empty input” non-fatal under `set -e` - With `set -euo pipefail`, commands like `grep` can exit 1 when nothing matches; treat that as an expected state (e.g., “empty blocklist”) instead of aborting. 3) Validate output marshalling before downstream parsing - When writing multi-line or JSON values to `$GITHUB_OUTPUT`, use the multiline-safe `<