formula_auditor: do not allow depending on aliases

[bayandin]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?
• Have you successfully run brew man locally and committed any changes?

---

This PR makes dependency audit more strict and prohibits using aliases (at all) in depends_on in homebrew-core:

  # Before both of these options were allowed (`openjdk@15` is an alias to `openjdk`:)
  depends_on "openjdk@15"
  depends_on "openjdk"
  
  # After it allows only:
  depends_on "openjdk"

Motivation:

• We'd like formulae to use the latest version of dependencies (when possible). When a new version of the formula appears we'd like all the depending on it formulae to start using it. So having openjdk@15 as a dependency will not allow us making this switch (to the next openjdk@16) automatically and will require manual formula tuning. Also, we don't have such kind of examples in homebrew-core;
• Currently, dependency audit doesn't work for [email protected] and [email protected] (these are special cases when an unversioned formula is an alias to versioned one). And it was easier to make this audit more strict than add tuning for these special cases 🙂

Existing violations fixed:

• in dotnet ncspot: use canonical names in dependencies homebrew-core#67521
• in https://github.com/Homebrew/linuxbrew-core/pull/21926

[BrewTestBot]

Review period will end on 2020-12-24 at 15:02:00 UTC.

[MikeMcQuaid]

We're checking here whether the formula being depended on is a core formula but I think we should be checking for both the dependency and the main formula because depending on a versioned alias is actively desirable outside of homebrew/core. Thoughts?

[bayandin]

You're right!
I've actually misread the condition, in my head exactly what you're saying 😄
I'll put this check after next unless @core_tap. And then we don't really need to check dep_f.core_formula? because formulae from homebrew-core can depend only on formulae from homebrew-core

[MikeMcQuaid]

• Currently, dependency audit doesn't work for [email protected] and [email protected] (these are special cases when an unversioned formula is an alias to versioned one). And it was easier to make this audit more strict than add tuning for these special cases 🙂

Does this mean they are a false positive, false negative or produce an error? Thanks!

[bayandin]

Does this mean they are a false positive, false negative or produce an error? Thanks!

It's a false negative, I guess.

Current logic says: a formula can't depend on aliases unless it's an alias to a versioned formula. So it allows aliases to versioned formulae (openssl -> [email protected]). And I suggest (in this PR) not to allow it at all

[MikeMcQuaid]

It's a false negative, I guess.

Assuming that means "we should complain but we don't": fine with me 👍🏻

[BrewTestBot]

Review period ended.