don't run "sh" even outside of tasks if --dry-run