less wrong way to propagate errors maybe

ci-tools/vulnerability-scan

@@ -34,6 +34,6 @@ fi
 # vulnix exits with an error status if there are vulnerabilities.  We told
 # GitLab to allow this by setting `allow_failure` to true in the GitLab CI
 # config.
-set +eo pipefail
-status=$(nix-shell -p vulnix --run 'vulnix ./scan-target/' | tee "$OUTPUT")
-exit $status
+set +e
+nix-shell -p vulnix --run 'vulnix ./scan-target/' | tee "$OUTPUT"
+exit $?