50 Commits

Author SHA1 Message Date
Sam Ford
3eb57bc41d
Remove temporary audit exception for lsr
This removes the temporary `audit_download_strategy` exception for
the `lsr` formula. This was necessary to be able to merge support for
tangled.sh Git URLs, as it made the `using: :git` argument in the
`lsr` formula redundant and caused the "formula audit" check to fail
in brew CI.
2025-09-01 09:50:10 -04:00
Sam Ford
46d4af6031
Temporarily skip audit_download_strategy for lsr
This is a temporary workaround to allow us to merge support for
tangled.sh Git URLs in `DownloadStrategyDetector`, as it makes the
`using: :git` argument in the `lsr` formula redundant and causes brew
CI to fail. We can't remove that argument from the formula until the
brew change is merged, so this allows us to do so. This should be
removed after the brew change is available in a release.

Co-authored-by: Carlo Cabrera <github@carlo.cab>
2025-09-01 08:22:40 -04:00
Issy Long
577aec3f60
Encourage using a default branch for HEAD core formulae
- We don't mind if third-party taps have non-default HEAD branches - they have their reasons.
- But we want -core to be consistent, hence why there's the allowlist file.
- https://github.com/Homebrew/brew/pull/20402#discussion_r2292366323
2025-08-26 14:26:11 +02:00
Eric Knibbe
827480f06b
messages/comments: wording fixes 2025-08-16 00:57:59 -04:00
Eric Knibbe
e021953db4
messages/comments: formatting fixes 2025-08-16 00:54:50 -04:00
Issy Long
d0e9a2d7d6
Always suggest a HEAD branch name if we can find one
- If a HEAD branch name isn't specified at all, then the user probably
  wants to shortcut adding one by being told what the default branch for
  the repo is. Otherwise they have to click the URL, look at the GitHub
  UI, then type the branch name into `branch: "foo"` syntax.
2025-08-11 13:46:49 +01:00
Issy Long
37eaed5bb7
Ensure that head Git URLs always specify a branch
- There's a TODO on the "someday" list [1] to ensure that `head` Git
  URLs always specify a branch.
- So I thought I'd automate this worry by adding an audit.
- Since `resource` block URLs tend to be pinned to SHAs, if indeed
  they are Git URLs, this audit only applies to `head` URLs.

[1]: https://github.com/orgs/Homebrew/projects/5?pane=issue&itemId=98789749
2025-08-10 20:28:50 +01:00
Osama Albahrani
69673221d4 resource_auditor.rb: Skip https audit for curl dependencies
The error message to be fixed:

```console
% brew audit --strict --online xz
xz
  * Stable: The source URL http://downloads.sourceforge.net/project/lzmautils/xz-5.8.1.tar.gz should use HTTPS rather than HTTP
Error: 1 problem in 1 formula detected.

% brew edit xz # change it to https

% brew audit --strict --online xz
xz
  * Stable: should always include at least one HTTP mirror
Error: 1 problem in 1 formula detected.
```

- Fixes https://github.com/Homebrew/brew/issues/15728
2025-08-01 18:01:09 +03:00
Eric Knibbe
cd6777fc73
audits: quote and reword problem description text 2025-05-30 23:49:26 -04:00
Issy Long
6ada9a9665
Add clarifying comments to rubocop:disables
- Needed for PR 18842 that adds a `DisableComment` RuboCop to ensure that all RuboCop disables have comments.
2025-01-12 16:59:07 +00:00
Issy Long
45978435e7
rubocop: Use Sorbet/StrictSigil as it's better than comments
- Previously I thought that comments were fine to discourage people from
  wasting their time trying to bump things that used `undef` that Sorbet
  didn't support. But RuboCop is better at this since it'll complain if
  the comments are unnecessary.

- Suggested in https://github.com/Homebrew/brew/pull/18018#issuecomment-2283369501.

- I've gone for a mixture of `rubocop:disable` for the files that can't
  be `typed: strict` (use of undef, required before everything else, etc)
  and `rubocop:todo` for everything else that should be tried to make
  strictly typed. There's no functional difference between the two as
  `rubocop:todo` is `rubocop:disable` with a different name.

- And I entirely disabled the cop for the docs/ directory since
  `typed: strict` isn't going to gain us anything for some Markdown
  linting config files.

- This means that now it's easier to track what needs to be done rather
  than relying on checklists of files in our big Sorbet issue:

```shell
$ git grep 'typed: true # rubocop:todo Sorbet/StrictSigil' | wc -l
    268
```

- And this is confirmed working for new files:

```shell
$ git status
On branch use-rubocop-for-sorbet-strict-sigils
Untracked files:
  (use "git add <file>..." to include in what will be committed)
        Library/Homebrew/bad.rb
        Library/Homebrew/good.rb

nothing added to commit but untracked files present (use "git add" to track)

$ brew style
Offenses:

bad.rb:1:1: C: Sorbet/StrictSigil: Sorbet sigil should be at least strict got true.
^^^^^^^^^^^^^

1340 files inspected, 1 offense detected
```
2024-08-12 15:24:27 +01:00
William Woodruff
de582fbdbf
resource_auditor: make typechecker happy
Signed-off-by: William Woodruff <william@yossarian.net>
2024-07-29 10:27:42 -04:00
William Woodruff
921fa5b6ed
resource_auditor: normalize PyPI names to kebab case before auditing
Signed-off-by: William Woodruff <william@yossarian.net>
2024-07-29 10:18:17 -04:00
Rui Chen
59633979dd
resource_auditor: add missing require
Signed-off-by: Rui Chen <rui@chenrui.dev>
2024-07-20 14:48:49 -04:00
William Woodruff
1ef8aeea49
resource_auditor: typechecking
Signed-off-by: William Woodruff <william@yossarian.net>
2024-07-14 13:04:06 -04:00
William Woodruff
bc7261c667
resource_auditor: fix wheel URL audit
Signed-off-by: William Woodruff <william@yossarian.net>
2024-07-14 13:01:05 -04:00
Markus Reiter
0f0055ede4
Make documentation @api private by default. 2024-04-26 19:04:20 +02:00
Mike McQuaid
ea2892f8ee
brew.rb: handle missing args. 2024-03-07 16:20:20 +00:00
Natalie Weizenbaum
da624b2f3c
Don't require "branch: main" for resources with revisions set
Just like when a tag is set, when a revision is set for a resource it shouldn't _also_ specify that it comes from the main branch.
2024-02-08 23:54:12 +00:00
Bo Anderson
e80bb70bed
Add retries to some online audit checks 2023-10-14 17:43:18 +01:00
Mike McQuaid
c1f79499af
Merge pull request #15942 from issyl0/audit-pypi-package-names-match-resource-names
Add an audit for mismatched Python resource and PyPi package names
2023-09-13 09:32:09 +01:00
Mike McQuaid
e7c4d7ebeb
resource_auditor: handle potential nil case. 2023-09-13 08:51:54 +01:00
Issy Long
bf163013d9
Use a regex instead of splitting the URL on / etc 2023-09-12 00:30:21 +01:00
Issy Long
08f58ab5f7
Skip when the resource name is the same as the formula name
- Otherwise we get an audit failure in, for example, the `twine-pypi`
  formula for the package name from its `url` that's actually `twine`.
- For this we only should track `resource "name"` blocks.
2023-09-06 23:29:09 +01:00
Issy Long
bb44d66e79
Python package names can have more characters in than just _ and - 2023-09-06 23:28:23 +01:00
Issy Long
94d4061589
Improve PyPI package name audit wording 2023-09-06 23:16:25 +01:00
Mike McQuaid
31b94e21ee
resource_auditor: also check versions based on bottle root_url. 2023-09-06 09:51:16 -04:00
Steve Peters
0ae29cc7fa
resource_auditor: relax version audit in taps
Disable the version regex audit for 3rd-party taps,
at least for now to allow time to comply.
2023-09-05 22:51:58 -07:00
Mike McQuaid
de4207f6d0
Audit invalid versions
We have a bunch of versions we've been meaning to adjust to not use
invalid GitHub Packages characters for a while. Let's audit for them
and plan for deprecating their use in future.
2023-09-05 16:43:36 -04:00
Ruoyu Zhong
41a810b2e0
resource_auditor: fix Utils::Curl usage
Needed after #15940.
2023-09-06 00:05:19 +08:00
Mike McQuaid
b7114651ac
utils/curl: include or use explicitly.
Include or use `Utils::Curl` explicitly everywhere it is used.
2023-09-04 22:17:57 -04:00
Issy Long
5d2ae98d0c
Add an audit for mismatched Python resource and PyPi package names
- Issue 14537.
- When people manually add or modify PyPI resources the `Resource#name`
  sometimes ends up out-of-sync with the PyPI package name.
2023-09-03 00:44:24 +01:00
Douglas Eichelberger
89eb891891 Disable false positive 2023-04-25 09:26:24 -07:00
Douglas Eichelberger
08af78a2a5 brew style --fix 2023-04-25 09:26:24 -07:00
Sam Ford
942f419a48
ResourceAuditor: Fix #audit_head_branch error
The existing logic in `#audit_head_branch` for identifying the `HEAD`
branch in a Git repository will give an ```undefined method `[]' for
nil:NilClass``` error when a repository doesn't provide this
reference. Expected output is as follows:

```
ref: refs/heads/master  HEAD
1a8f9ac700873d1a08de31a17a2fd654245d5085  HEAD
```

However, I encountered this error for a repository with the following
output (i.e., where no symref is provided for HEAD):

```
f86be659718c0cd0a67f88b42f07044c23d0d028  HEAD
```

This commit resolves the error by modifying the related logic to
account for a `nil` value.
2022-10-17 13:28:20 -04:00
Rylan Polster
ea1f2098ac
Move HOMEBREW_SIMULATE_MACOS_ON_LINUX handling to SimulateSystem 2022-07-28 15:04:25 -04:00
Sam Ford
d649026c10
ResourceAuditor: Skip branch error when using tag 2021-10-20 12:46:53 -04:00
Bo Anderson
f0e4fb9cb8
resource_auditor: restore curl HTTP mirror auditing 2021-10-05 13:27:42 +01:00
Michka Popoff
07df4a7e70
Use Homebrew curl for audit and fetch when specified in the formula
Introduce new :using for urls
2021-08-17 13:35:55 +02:00
Nanda H Krishna
5191199957
resource_auditor: use if instead of unless
Co-authored-by: Mike McQuaid <mike@mikemcquaid.com>
2021-08-12 19:28:06 +05:30
Nanda H Krishna
f69f9be233
Add allowlist, make branch: mandatory 2021-08-12 12:43:22 +05:30
Nanda H Krishna
d75320069f
resource_auditor: add audit for HEAD default branch 2021-08-12 12:43:21 +05:30
Sam Ford
a1cf581118
ResourceAuditor: Allow only/except options 2021-06-16 10:30:52 -04:00
Kenneth Chew
af594739dc
audit: specify which URL has a content problem in problem message 2021-04-22 13:52:18 +01:00
Mike McQuaid
d73351251c
Deprecate, disable, delete code for next major/minor version.
Do the usual dance for bumping our major/minor version.
2021-04-09 09:30:36 +01:00
nandahkrishna
8e5451df2f
style: use parentheses for assignment in conditions 2021-02-12 18:33:37 +05:30
Rylan Polster
180d8ca2b2
utils/curl: use specs when checking http content problems 2021-01-23 17:30:59 -05:00
Alexander Bayandin
8717f82b9d dev-cmd/audit: add audit for checksum 2020-12-08 23:42:46 +00:00
Markus Reiter
5be4c9b5e0 Upgrade typed sigils. 2020-11-25 17:04:19 +01:00
Markus Reiter
dc11f02e16 Move auditor classes into separate files. 2020-11-18 11:22:27 +01:00