curl's exit status reports transport-level success. A completed request that returned 404, 500, or any other error status is a successful transfer, so 'curl URL -o file && install file' proceeds with an HTML error page saved as the artifact. This is the single most common cause of a CI job that installs a zero-byte or garbage binary.
'--fail', or '-f', makes curl exit 22 on a response status of 400 or greater and suppress the body. That solves the pipeline but destroys the error message, which is exactly what you need when debugging an API call.
curl 7.76.0, released in April 2021, added '--fail-with-body', which sets the same non-zero exit status while still writing the response body, so scripts get both the failure signal and the server's explanation. Use it wherever the curl version allows. Note that --fail does not apply to a 401 or 407 when curl is going to retry with credentials, and that with -f curl may still write a partial file before deciding to fail, so remove the output file on failure.