audit: check GitHub tags for prerelease status

[dtrodrigues]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

For GitHub formulae based on a tag vs a release, see if there is a corresponding release and if so, check to see if it's a prerelease.

$ brew audit --online cbmc
cbmc:
  * cbmc-5.12.6 is a GitHub prerelease
Error: 1 problem in 1 formula detected

[MikeMcQuaid]

Good catch 👏🏻. Could you let the relevant upstream(s) know that we're doing this to hopefully help them in future, too?

[dtrodrigues]

The 5 affected formulae are

cbmc.rb
elm-format.rb
infrakit.rb
riff.rb
volta.rb

telegram-cli is also a GitHub prerelease based on a tag but is already in the allowlist and the one other formula on the allowlist is gitless.

I'll file an issue with the five above prior to merging this, but I'm wondering if we should contact the other two/get rid of the the allowlist for prerelease since Homebrew should be packaging/distributing stable software, and the GitHub prerelease tag implies that the tag is not ready for production:

To notify users that the release is not ready for production and may be unstable, select This is a pre-release.

https://docs.github.com/en/github/administering-a-repository/managing-releases-in-a-repository#creating-a-release

[dtrodrigues]

Previous discussion about prerelease: #7177
Previous discussion about prerelease allowlist: #7737

[dtrodrigues]

In the short term, it might make the most sense to allow the current prerelease formula versions to remain and then have a conversation with the upstream projects when somebody tries to update the formula, so I added the few existing prerelease formulae to the allowlist and also added a check to ensure the formula version matches the allowlist version.

more changes made

[MikeMcQuaid]

In the short term, it might make the most sense to allow the current prerelease formula versions to remain and then have a conversation with the upstream projects when somebody tries to update the formula

Agreed 👍🏻. Great work @dtrodrigues!