[jkelley-godaddy]

Description of changes:
Adds optional version flag to install script.

We are looking to pin a specific version to ensure that we do not encounter unexpected breaking changes during a major version upgrade. The existing install script works well for our team (we use OSX and Ubuntu via WSL) except we cannot specify a version during installation.

This change would allow users to optionally specify a version while running the installation while being backwards compatible. If a version is not specified the script defaults to the latest version which is the current behavior.

It appears specifying the version during installation may have been possible in the past as indicated by this portion of the installation instructions in the README: (change version=X for other versions) - however version=X is no longer present in the current command.

Alternative solutions:
The ideal solution for us would be an asdf plugin. We use mise as our tool manager which is asdf compatible. This has the following benefits over the bash script:

• Allows installation during tool manager initialization in a central location.
• Automatically adds/removes tool from PATH.
• Provides an easy un-install method.

However the development/maintenance of a full asdf plugin does not currently make sense when we can achieve the majority of the benefit with a small modification to the existing installation script.

If someone else would like create an asdf plugin and close this pull request I would welcome that contribution :)

We did try building using rust/cargo however this requires 70 seconds to complete every CICD run versus 2 seconds to use the script that gets the release binary, making it too time expensive to be viable.

Additionally we are aware of the pre-commit hooks for Guard unfortunately these are not part of our current local/CICD workflow but may be an excellent option for other teams.

Testing done:
It appears there is already a test for the default case in the pr.yml GitHub actions workflow. If desired the following test could be prepended ahead of the current one to test installation of a known good version in CICD:

      - name: Test install script on ${{ matrix.os }} with specific version
        run: |
          set -e
          cd cloudformation-guard
          sh install-guard.sh -s -- -v 3.1.1

Tested the following scenarios manually:

No version flag specified - defaults to latest (backwards compatible):

╰❯ cat install-guard.sh | sh
Installing cfn-guard version '3.1.1'...

Version specified as a valid semver:

╰❯ cat install-guard.sh | sh -s -- -v 3.1.0
Installing cfn-guard version '3.1.0'...

Version specified as an invalid version:

╰❯ cat install-guard.sh | sh -s -- -v 1.2.3
Installing cfn-guard version '1.2.3'...
curl: (22) The requested URL returned error: 404
error attempting to download from the github repository

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[dsilbergleithcu-godaddy]

This meets the needs of our project. Nice work @jkelley-godaddy

[jkelley-godaddy]

Fixed the shellcheck errors and reverted a change that attempted to name the binary in ~/.guard to the actual version instead of latest. It turns out that every release binary is hard-coded to end with latest - not the actual version number. You can see this in the GitHub release Assets, all asset names end in -latest for every release.

I believe this should now pass all automated checks.

[dannyvassallo]

Looks great - thanks for the contribution!

[joshfried-aws]

This looks awesome, thanks for the contribution!

[joshfried-aws]

@jkelley-godaddy Hey, just checking in if you want me to merge it for you?

[jkelley-godaddy]

Yes please. I am not authorized to merge and it appears everything is in order. Thank you for your assistance!