[RyanMeline]

Put an x into the box if that apply:

• This PR introduces breaking change.
• This PR fixes a bug.
• This PR adds new functionality.
• This PR enhances existing functionality.

Description of your changes

tools/install/trivy.sh builds its GitHub release-asset regex using
$TARGETOS directly (uname -s, lowercased), e.g. darwin on macOS.

Trivy's release assets are named with macOS instead
(trivy_0.74.0_macOS-ARM64.tar.gz), so the regex never matches on any
Mac, for any --tool-version (pinned or latest), regardless of GITHUB_TOKEN.

• Pinned version -> looks like a rate-limit issue: "could not find a release asset matching version... looked through up to 20 pages,"
  because it finds a match.
• latest -> a curl crash ("blank argument where content is
  expected"), since the empty match feeds curl a malformed URL.

This adds a darwin -> macOS translation for $TARGETOS, mirroring
the amd64 -> 64bit translation already done for $TARGETARCH two
lines above it, and the OS-name mapping terrascan.sh already does for
its vendor's naming convention (Darwin, capitalized).

How can we test changes

---

Test 1 -
Standalone repro (no pre-commit needed):

export TRIVY_VERSION=0.74.0 TARGETOS=darwin TARGETARCH=arm64
bash tools/install/trivy.sh
./trivy --version

Fails on master, succeeds with this patch.

---

Test 2 -
Tested on macOS (Apple Silicon, arm64) using pre-commit try-repo-style
local testing against a throwaway Terraform repo containing a single
.tf file with a deliberate misconfiguration (an aws_s3_bucket
resource missing encryption/versioning), to confirm trivy actually
executes against real content rather than just confirming a binary
downloads.

• Against master (before this fix): terraform_trivy fails during
  installation with ERROR: could not find a 'trivy' release asset matching version '0.74.0' (looked through up to 20 page(s) of releases) - the installer never resolves a download URL.
• Against this branch (after this fix): the installer correctly
  downloads trivy, and the hook runs trivy against the test file,
  which flags the missing bucket encryption/versioning as expected -
  confirming trivy both installed and executed successfully.

Cache was cleared between runs (~/.cache/pre-commit,
~/.cache/pre-commit-terraform) to ensure each test exercised the
installer fresh rather than reusing a cached binary.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: antonbabenko/pre-commit-terraform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 51b765c4-0e35-4bcb-a485-c9e29e2d0846

📥 Commits

Reviewing files that changed from the base of the PR and between 80c8033 and c35fc53.

📒 Files selected for processing: 1

• tools/install/trivy.sh

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📝 Summary

Summary by CodeRabbit

• Bug Fixes
  • Improved Trivy release matching for latest and version-specific installs across operating systems, including macOS. This helps ensure the appropriate release is selected for the detected platform.

The Trivy installer maps TARGETOS value darwin to macOS. Both latest and version-specific release URL patterns use the normalized OS value.

Changes: Trivy installer

Layer / File(s)	Summary
Normalize release OS tools/install/trivy.sh	The installer maps darwin to macOS and uses the resulting OS value in both release URL patterns.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to c35fc

The installer can now select macOS Trivy assets, with no identified merge-blocking risk introduced by this change.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description clearly explains the macOS Trivy asset-name mismatch, the installer fix, and the reported tests.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes the main change: correcting the macOS asset name in the Trivy installer script.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[antonbabenko]

This PR is included in version 1.109.3 🎉