Fix how the version override is provided to the install script

[hobofan]

Resolves #78

Summary by CodeRabbit

• Bug Fixes
  • Fixed Docker builds using the latest version setting.
  • Improved installation handling for explicitly specified versions.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Docker build now uses the default Kubescape installer for latest and passes explicit versions through the installer’s -v option.

Changes

Kubescape installation

Layer / File(s)	Summary
Installer version selection Dockerfile	The installation command branches on KUBESCAPE_VERSION. It uses the default installer for latest and passes -v for other values.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: correcting how the version override is passed to the install script.
Linked Issues check	✅ Passed	The changes pass explicit versions with the install script's -v option, which addresses issue #78.
Out of Scope Changes check	✅ Passed	The changes are limited to version argument handling in the Dockerfile and support the linked issue objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile`:
- Around line 4-8: Update the Kubescape installer commands in both branches of
the Dockerfile conditional to use curl failure handling, such as -fsSL, before
piping the downloaded script to Bash, ensuring network, DNS, and HTTP download
failures cause the Docker build to fail.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 42042d9b-9a30-4d68-a5b1-9e1d2f13c55a

📥 Commits

Reviewing files that changed from the base of the PR and between 7d90c1f and 6cae5e1.

📒 Files selected for processing (1)

• Dockerfile

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Fail the build when the installer download fails.

Both branches pipe curl -s into Bash. If the download fails because of a network or DNS error, Bash can receive empty input and return success. The Docker build can then produce an image without Kubescape.

Download the script with curl -fsSL before executing it, or enable pipeline failure handling.

Proposed fix

-RUN if [ "${KUBESCAPE_VERSION}" = "latest" ]; then \
-      curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash; \
-    else \
-      curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash -s -- -v "${KUBESCAPE_VERSION}"; \
-    fi
+RUN curl -fsSL https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh -o /tmp/kubescape-install.sh && \
+    if [ "${KUBESCAPE_VERSION}" = "latest" ]; then \
+      /bin/bash /tmp/kubescape-install.sh; \
+    else \
+      /bin/bash /tmp/kubescape-install.sh -v "${KUBESCAPE_VERSION}"; \
+    fi && \
+    rm -f /tmp/kubescape-install.sh

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	RUN if [ "${KUBESCAPE_VERSION}" = "latest" ]; then \
	curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash; \
	else \
	curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash -s -- -v "${KUBESCAPE_VERSION}"; \
	fi
	RUN curl -fsSL https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh -o /tmp/kubescape-install.sh && \
	if [ "${KUBESCAPE_VERSION}" = "latest" ]; then \
	/bin/bash /tmp/kubescape-install.sh; \
	else \
	/bin/bash /tmp/kubescape-install.sh -v "${KUBESCAPE_VERSION}"; \
	fi && \
	rm -f /tmp/kubescape-install.sh

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@Dockerfile` around lines 4 - 8, Update the Kubescape installer commands in
both branches of the Dockerfile conditional to use curl failure handling, such
as -fsSL, before piping the downloaded script to Bash, ensuring network, DNS,
and HTTP download failures cause the Docker build to fail.

[matthyx]

Verified by building the Dockerfile with --build-arg KUBESCAPE_VERSION=v4.0.11 (the exact scenario from #78): the installed binary now correctly reports v4.0.11 instead of silently pulling latest. KUBESCAPE_VERSION=latest path (used implicitly since action.yml always resolves latest to a concrete tag before build) still works too.

The install.sh script only accepts a version via the -v getopt flag (never read KUBESCAPE_VERSION from env), so this fix is correct. LGTM, no blockers.