[BUG] cmd.run with unless argument doesn't respect failure of the pipe

Description

It appears that the requisite unless doesn't respect pipefail.

cat /root/.docker/config.json | jq '.credHelpers| has("gcr.io")' -e
cat: /root/.docker/config.json: No such file or directory

Setup

gcr-configure-docker:
    cmd.run:
    - name: "docker-credential-gcr configure-docker"
    - require:
      - file: ...
    # only run this command if the docker config for root has not been configured
    - unless: cat /root/.docker/config.json | jq '.credHelpers| has("gcr.io")' -e

Steps to Reproduce the behavior

cmd.retcode 'cat /root/.docker/config.json | jq ".credHelpers | has(\"gcr.io\")" -e'
File doesn't exist:
HOST:
    0
File exist missing key
HOST:
    1
File exists- with key
HOST:
    0

cmd.retcode 'jq ".credHelpers | has(\"gcr.io\")" -e /root/.docker/config.json'
File doesn't exist:
HOST:
     2
File exist missing key
HOST:
    1
File exists- with key
HOST:
    0

Expected behavior
I expected that a failure of any part of the command would cause the entire command to fail, but I'm not sure if this is

• bad expectation
• unclear documentation
• incorrect behavior

Versions Report

$ salt-ssh --versions-report
Salt Version:
           Salt: 2019.2.4

Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.4.2
      docker-py: Not Installed
          gitdb: 0.6.4
      gitpython: 1.0.1
          ioflo: Not Installed
         Jinja2: 2.8
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.4.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 3.5.2 (default, Oct  7 2020, 17:19:02)
   python-gnupg: 0.3.8
         PyYAML: 3.11
          PyZMQ: 15.2.0
           RAET: Not Installed
          smmap: 0.9.0
        timelib: Not Installed
        Tornado: 4.2.1
            ZMQ: 4.1.4

System Versions:
           dist: Ubuntu 16.04 xenial
         locale: ANSI_X3.4-1968
        machine: x86_64
        release: 4.15.0-126-generic
         system: Linux
        version: Ubuntu 16.04 xenial

Additional context
I can get around this by using a single command, but that is not true for other instances where a pipe is beneficial.

Start with salt/state.py around the linked unless implementation and reproduce the behavior using the two cmd.retcode examples. Compare the pipeline exit status with the direct jq command and trace how cmd.run evaluates unless. Done when the intended pipe-failure behavior is established and covered by an appropriate regression test or clarified in documentation.