Merge branch 'master' into formula-api

Homebrew · Nov 8, 2024 · e910cb5 · e910cb5
2 parents b89d282 + 7681fba
commit e910cb5
Show file tree

Hide file tree

Showing 172 changed files with 3,209 additions and 1,849 deletions.
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
@@ -26,10 +26,12 @@ concurrency:
   group: "actionlint-${{ github.ref }}"
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions: {}
+
 jobs:
   workflow_syntax:
     if: github.repository_owner == 'Homebrew'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Set up Homebrew
         id: setup-homebrew
@@ -39,17 +41,45 @@ jobs:
           cask: false
           test-bot: false
 
-      - name: Set up actionlint
+      - name: Install tools
+        run: brew install actionlint shellcheck zizmor
+
+      - name: Set up GITHUB_WORKSPACE
         env:
           HOMEBREW_REPOSITORY: ${{ steps.setup-homebrew.outputs.repository-path }}
         run: |
-          brew install actionlint shellcheck
-
           # Annotations work only relative to GITHUB_WORKSPACE
           (shopt -s dotglob; rm -rf "${GITHUB_WORKSPACE:?}"/*; mv "${HOMEBREW_REPOSITORY:?}"/* "$GITHUB_WORKSPACE")
           rmdir "$HOMEBREW_REPOSITORY"
           ln -vs "$GITHUB_WORKSPACE" "$HOMEBREW_REPOSITORY"
 
           echo "::add-matcher::.github/actionlint-matcher.json"
 
+      - run: zizmor --format sarif . >results.sarif
+
+      - name: Upload SARIF file
+        uses: actions/upload-artifact@v4
+        with:
+          name: results.sarif
+          path: results.sarif
+
       - run: actionlint
+
+  upload_sarif:
+    needs: workflow_syntax
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - name: Download SARIF file
+        uses: actions/download-artifact@v4
+        with:
+          name: results.sarif
+          path: results.sarif
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor
diff --git a/.github/workflows/autogenerated-files.yml b/.github/workflows/autogenerated-files.yml
@@ -22,7 +22,7 @@ defaults:
 
 jobs:
   autogenerated:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     if: github.repository == 'Homebrew/brew'
     steps:
       - name: Set up Homebrew
@@ -34,7 +34,7 @@ jobs:
           test-bot: true
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
@@ -15,23 +15,25 @@ defaults:
 jobs:
   analyze:
     name: Analyze
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f779452ac5af1c261dce0346a8f964149f49322b # v3
+        uses: github/codeql-action/init@662472033e021d55d94146f66f6058822b0b39fd # v3
         with:
           languages: ruby
           config: |
             paths-ignore:
               - Library/Homebrew/vendor
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f779452ac5af1c261dce0346a8f964149f49322b # v3
+        uses: github/codeql-action/analyze@662472033e021d55d94146f66f6058822b0b39fd # v3
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -21,14 +21,14 @@ jobs:
   ubuntu:
     if: github.repository_owner == 'Homebrew'
     name: docker (Ubuntu ${{ matrix.version }})
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         version: ["18.04", "20.04", "22.04", "24.04"]
     steps:
       - name: Checkout
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           fetch-depth: 0
           persist-credentials: false

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -23,7 +23,7 @@ defaults:
 
 jobs:
   docs:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew
@@ -34,7 +34,9 @@ jobs:
           test-bot: false
 
       - name: Checkout repository
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        with:
+          persist-credentials: false
 
       - name: Install vale
         run: brew install vale
@@ -53,7 +55,7 @@ jobs:
         run: vale docs/
 
       - name: Install Ruby
-        uses: ruby/setup-ruby@f26937343756480a8cb3ae1f623b9c8d89ed6984 # v1.196.0
+        uses: ruby/setup-ruby@46ca53beb334a2329bcd0e46a694816a6ae6d173 # v1.201.0
         with:
           bundler-cache: true
           working-directory: docs

diff --git a/.github/workflows/doctor.yml b/.github/workflows/doctor.yml
@@ -22,7 +22,7 @@ defaults:
 
 jobs:
   determine-runners:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     outputs:
       runners: ${{ steps.determine-runners.outputs.runners }}
     steps:

diff --git a/.github/workflows/pkg-installer.yml b/.github/workflows/pkg-installer.yml
@@ -79,7 +79,7 @@ jobs:
         run: rm -f "${RUNNER_TEMP}/${TEMPORARY_CERTIFICATE_FILE}"
 
       - name: Checkout another Homebrew to brew subdirectory
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: brew
           fetch-depth: 0
@@ -96,12 +96,14 @@ jobs:
         run: security list-keychain -d user -s "${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}"
 
       - name: Build Homebrew installer component package
+        env:
+          HOMEBREW_VERSION: ${{ steps.homebrew-version.outputs.version }}
         # Note: `Library/Homebrew/test/support/fixtures/` contains unsigned
         # binaries so it needs to be excluded from notarization.
         run: pkgbuild --root brew
                       --scripts brew/package/scripts
                       --identifier sh.brew.homebrew
-                      --version "${{ steps.homebrew-version.outputs.version }}"
+                      --version "${HOMEBREW_VERSION}"
                       --install-location /opt/homebrew
                       --filter .DS_Store
                       --filter "(.*)/Library/Homebrew/test/support/fixtures/"
@@ -114,11 +116,13 @@ jobs:
               pandoc --from markdown --standalone --output brew/package/resources/LICENSE.rtf
 
       - name: Build Homebrew installer product package
+        env:
+          HOMEBREW_VERSION: ${{ steps.homebrew-version.outputs.version }}
         run: productbuild --resources brew/package/resources
                           --distribution brew/package/Distribution.xml
                           --package-path Homebrew.pkg
                           --sign "${PKG_APPLE_DEVELOPER_TEAM_ID}"
-                          Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
+                          "Homebrew-${HOMEBREW_VERSION}.pkg"
 
       - name: Clean up temporary macOS keychain
         if: ${{ always() }}
@@ -129,7 +133,7 @@ jobs:
           fi
 
       - name: Generate build provenance
-        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018 # v1.4.4
         with:
           subject-path: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
 
@@ -173,7 +177,9 @@ jobs:
         run: echo | sudo tee /var/log/install.log
 
       - name: Install Homebrew from installer package
-        run: sudo installer -verbose -pkg "${{ needs.build.outputs.installer_path }}" -target /
+        env:
+          INSTALLER_PATH: ${{ needs.build.outputs.installer_path }}
+        run: sudo installer -verbose -pkg "${INSTALLER_PATH}" -target /
 
       - name: Output installer logs
         if: ${{ always() }}
@@ -187,7 +193,9 @@ jobs:
         run: echo | sudo tee /var/log/install.log
 
       - name: Reinstall Homebrew from installer package
-        run: sudo installer -verbose -pkg "${{ needs.build.outputs.installer_path }}" -target /
+        env:
+          INSTALLER_PATH: ${{ needs.build.outputs.installer_path }}
+        run: sudo installer -verbose -pkg "${INSTALLER_PATH}" -target /
 
       - name: Output installer logs (again)
         if: ${{ always() }}
@@ -213,7 +221,8 @@ jobs:
         env:
           PKG_APPLE_ID_EMAIL: ${{ secrets.PKG_APPLE_ID_EMAIL }}
           PKG_APPLE_ID_APP_SPECIFIC_PASSWORD: ${{ secrets.PKG_APPLE_ID_APP_SPECIFIC_PASSWORD }}
-        run: xcrun notarytool submit "${{ needs.build.outputs.installer_path }}"
+          INSTALLER_PATH: ${{ needs.build.outputs.installer_path }}
+        run: xcrun notarytool submit "${INSTALLER_PATH}"
                                     --team-id  "${PKG_APPLE_DEVELOPER_TEAM_ID}"
                                     --apple-id "${PKG_APPLE_ID_EMAIL}"
                                     --password "${PKG_APPLE_ID_APP_SPECIFIC_PASSWORD}"
@@ -226,9 +235,10 @@ jobs:
         if: github.event_name == 'release'
         env:
           GH_TOKEN: ${{ github.token }}
+          INSTALLER_PATH: ${{ needs.build.outputs.installer_path }}
         run: gh release upload --repo Homebrew/brew
                                 "${GITHUB_REF//refs\/tags\//}"
-                                "${{ needs.build.outputs.installer_path }}"
+                                "${INSTALLER_PATH}"
 
   issue:
     needs: [build, test, upload]

diff --git a/.github/workflows/rubydoc.yml b/.github/workflows/rubydoc.yml
@@ -23,7 +23,7 @@ defaults:
 jobs:
   rubydoc:
     if: github.repository == 'Homebrew/brew'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     env:
       BUNDLE_GEMFILE: ${{ github.workspace }}/rubydoc/Gemfile
     steps:
@@ -36,13 +36,14 @@ jobs:
           test-bot: false
 
       - name: Checkout Homebrew/rubydoc.brew.sh
-        uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: Homebrew/rubydoc.brew.sh
           path: rubydoc
+          persist-credentials: false
 
       - name: Install Ruby
-        uses: ruby/setup-ruby@f26937343756480a8cb3ae1f623b9c8d89ed6984 # v1.196.0
+        uses: ruby/setup-ruby@46ca53beb334a2329bcd0e46a694816a6ae6d173 # v1.201.0
         with:
           bundler-cache: true
           working-directory: rubydoc

diff --git a/.github/workflows/schemas.yml b/.github/workflows/schemas.yml
@@ -19,7 +19,7 @@ defaults:
 jobs:
   spdx:
     if: github.repository == 'Homebrew/brew'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew

diff --git a/.github/workflows/spdx.yml b/.github/workflows/spdx.yml
@@ -19,7 +19,7 @@ defaults:
 jobs:
   spdx:
     if: github.repository == 'Homebrew/brew'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: Set up Homebrew
         id: set-up-homebrew

diff --git a/.github/workflows/sponsors-maintainers-man-completions.yml b/.github/workflows/sponsors-maintainers-man-completions.yml
@@ -27,7 +27,7 @@ defaults:
 
 jobs:
   updates:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     if: github.repository == 'Homebrew/brew'
     steps:
       - name: Setup Homebrew
@@ -49,7 +49,7 @@ jobs:
           signing_key: ${{ secrets.BREWTESTBOT_GPG_SIGNING_SUBKEY }}
 
       - name: Cache Bundler RubyGems
-        uses: actions/cache@3624ceb22c1c5a301c8db4169662070a689d9ea8 # v4
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
         with:
           path: ${{ steps.set-up-homebrew.outputs.gems-path }}
           key: ${{ runner.os }}-rubygems-${{ steps.set-up-homebrew.outputs.gems-hash }}

diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml
@@ -12,10 +12,7 @@ on:
     - cron: "0 0 * * *"
   issue_comment:
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: {}
 
 defaults:
   run:
@@ -35,6 +32,10 @@ jobs:
         )
       )
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: Mark/Close Stale Issues and Pull Requests
         uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9
@@ -61,6 +62,10 @@ jobs:
         )
       )
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: Mark/Close Stale `bump-formula-pr` and `bump-cask-pr` Pull Requests
         uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9