From 9b0fdf75a3342a5cd979b6c36f76295d14d375d9 Mon Sep 17 00:00:00 2001
From: Arcadiy Ivanov <arcadiy@ivanov.biz>
Date: Sun, 1 Nov 2026 18:36:11 -0500
Subject: [PATCH] Limit Homebrew Python setup to Python and its dependencies

The Homebrew setup step ran `brew upgrade --overwrite`, which upgrades
every outdated formula on the runner image. Homebrew no longer builds
Intel bottles, so on `macos-15-intel` that means compiling dozens of
unrelated formulae (cmake, openssl, z3, net-snmp, ...) from source,
stalling jobs for hours.

Drop the global upgrade and the global `brew cleanup`, and run the step
with `HOMEBREW_NO_AUTO_UPDATE`, `HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK`
and `HOMEBREW_NO_INSTALL_CLEANUP` so that only Python and its own
dependencies are installed or upgraded, without cascading into their
dependents. The explicit `brew update` is kept so the latest `python@X`
formula is used.

Dependencies that `brew install` upgrades implicitly are linked without
`--overwrite`, which fails when the runner image has a conflicting link
(e.g. `/usr/local/bin/openssl` owned by `openssl@1.1` while upgrading
`openssl@3` for Python <= 3.13). Python's outdated dependencies are
therefore upgraded explicitly with `--overwrite` before installing it.
---
 README.md  |  3 ++-
 action.yml | 15 +++++++++++++--
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 59f9e17..2a9a187 100644
--- a/README.md
+++ b/README.md
@@ -94,7 +94,8 @@ Python is installed via `actions/setup-python@v7`, unless Homebrew is requested.
 
 #### Whether to Install Python with Homebrew
 
-Install Python via Homebrew instead. This only has effect on MacOS.
+Install Python via Homebrew instead. This only has effect on MacOS. Only `python@<version>` and its own
+dependencies are installed or upgraded; other formulae already present on the runner are left as they are.
 
 ```yaml
   homebrew-python:
diff --git a/action.yml b/action.yml
index 1acb9b9..675d6b9 100644
--- a/action.yml
+++ b/action.yml
@@ -143,15 +143,26 @@ runs:
     - name: Setup Python with Homebrew
       shell: bash
       if: inputs.install-python == 'true' && runner.os == 'macOS' && inputs.homebrew-python == 'true'
+      env:
+        # Only touch Python and its own dependencies, not every formula on the runner image
+        HOMEBREW_NO_AUTO_UPDATE: '1'
+        HOMEBREW_NO_INSTALLED_DEPENDENTS_CHECK: '1'
+        HOMEBREW_NO_INSTALL_CLEANUP: '1'
+        HOMEBREW_NO_ENV_HINTS: '1'
       run: |
         brew update
-        brew upgrade --overwrite
         brew uninstall --force --ignore-dependencies 'python@${{ inputs.python-version }}' || true
+        # Dependencies that `brew install` upgrades implicitly are linked without `--overwrite`,
+        # so upgrade Python's outdated dependencies explicitly first
+        PYTHON_DEPS="$(brew deps 'python@${{ inputs.python-version }}')"
+        OUTDATED_DEPS="$(brew outdated --formula --quiet | grep -Fx -f <(echo "$PYTHON_DEPS") || true)"
+        if [ -n "$OUTDATED_DEPS" ]; then
+          brew upgrade --overwrite $OUTDATED_DEPS
+        fi
         brew install --overwrite 'python@${{ inputs.python-version }}'
         echo "/usr/local/opt/python@${{ inputs.python-version }}/Frameworks/Python.framework/Versions/${{ inputs.python-version }}/bin" >> $GITHUB_PATH
         echo "/usr/local/opt/python@${{ inputs.python-version }}/libexec/bin" >> $GITHUB_PATH
         echo "/usr/local/opt/python@${{ inputs.python-version }}/bin" >> $GITHUB_PATH
-        brew cleanup
 
     - name: Python Pre-VENV Check
       shell: bash