upgrade: auto-tap formulae or casks before upgrading

[gibfahn]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?
• AI was used to generate or assist with generating this PR. Claude wrote

When you brew install org/tap/formula-name, it automatically taps the
repo if not present. Mirror this behaviour in brew upgrade so that
specifying a tap-prefixed name works the same way.

The use-case here is a formula adding a depends_on my-org/my-tap/my-formula line. This will work fine for people who brew install the formula fresh, but not for people who brew upgrade an
existing formula.

I made a similar change for brew bundle install in 451eda1

[MikeMcQuaid]

I don't think this makes sense as-is.

brew upgrade a/b/c doesn't really make sense if a/b is untapped as a/b/c wouldn't be installed.

If it's for dependencies specifically: that should be handled differently.

[gibfahn]

🤦 I forgot I had to fix this. Will add some tests and check that it works properly, sorry for the noise.

[MikeMcQuaid]

@gibfahn before pushing more: let's talk about the actual behaviour. As-is: I don't agree with this. The trust model for taps is such that they should be installed when explicitly requested by the user. If any tap can trigger any installation of another tap: that is bad. If brew install does that and brew upgrade does not: we should undo the brew install behaviour and not add it to brew upgrade

[gibfahn]

before pushing more: let's talk about the actual behaviour

Fair enough, I didn't realise the brew install behaviour wasn't intentional.

As-is: I don't agree with this. The trust model for taps is such that they should be installed when explicitly requested by the user. If any tap can trigger any installation of another tap: that is bad.

If brew install does that

Yeah it does

we should undo the brew install behaviour and not add it to brew upgrade

Happy to talk, but not having this makes having dependencies on other taps a pain. I know this isn't a problem for homebrew-core, but third-party taps are a valid use-case right?

Let's say you have:

# my-org/tap/my-formula

depends_on "other-org/tap/my-dependency"

Then when the person writing the formula tests it locally it will work, but when they run it remotely it won't because the other tap hasn't been tapped.

Maybe brew should have a flag or should prompt to install the tap instead?

[MikeMcQuaid]

Maybe brew should have a flag or should prompt to install the tap instead?

Yeh, I think it should error out and tell you to tap the tap rather than doing so automatically for brew install or brew upgrade.