diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4d044eeece2152a96c0a183b9ef50a39bb8e8db8..2588b11817c3eb8d6eacc115d2434c9744af1909 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -30,7 +30,7 @@ check:
     - echo -n "${ANSIBLE_VAULT_PASSWORD}" > .ansible_vault_pw
     - export ANSIBLE_VAULT_PASSWORD_FILE=.ansible_vault_pw
     - with-ssh-key ansible-playbook -i hosts.ini --diff --check site.yml
-    - grep changed= ansible.log | grep -q -v changed=0 && false
+    - ./ci/has-changed ansible.log
   artifacts:
     paths:
       - ansible.log
diff --git a/ci/has-changed b/ci/has-changed
new file mode 100755
index 0000000000000000000000000000000000000000..2d00096351e661e8b614dc94b757ae331a8ee83e
--- /dev/null
+++ b/ci/has-changed
@@ -0,0 +1,10 @@
+#!/bin/sh
+
+log="$1"
+
+if grep changed= $log | grep -v -q changed=0; then
+    echo "changes were detected" >&2
+    exit 1
+fi
+
+exit 0