formula_audit: fix tag ref for pypi source

[chenrui333]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

• found the license check failure in codelimit: bump python resources homebrew-core#168759

[cho-m]

This won't work for linked PR (codelimit) as it will result in tag = "codelimit-0.8.1" and just skip the check, which probably isn't what we want as default behavior.

❯ brew ruby -e 'require "formula"; p Formula["codelimit"].stable.url.match(%r{/([^/]*)\.tar\.gz$})[1]'
"codelimit-0.8.1"

If we are skipping license check, it should be explicit (i.e. audit exception) in order for maintainers to manually confirm.

codelimit would need to be run on tag = "v0.8.1", which isn't easy to get from the PyPI tarball (i.e. would need to try multiple attempts perhaps based on "common" formats of version).

❯ brew ruby -e '["codelimit-0.8.1", "0.8.1", "v0.8.1", nil].each { |tag| p GitHub.get_repo_license("getcodelimit", "codelimit", ref: tag) }'
nil
nil
"ISC"
"GPL-3.0"

Anyway, when we are guessing tag from non-GitHub URL, we should always fallback on tag = nil if GitHub.get_repo_license returns nil to avoid unwanted bypass.

---

On side note, if upstream was willing to upload license to PyPI, we could consider adding a check there and prioritize it over GitHub, but may need to transform info to match our expected SPDX format and would require sufficiently standardized output.

❯ curl -sL "https://pypi.org/pypi/codelimit/0.8.1/json" | jq '.info.license'
""

❯ curl -sL "https://pypi.org/pypi/awscli/json" | jq '.info.license'
"Apache License 2.0"

[chenrui333]

close in favor of Homebrew/homebrew-core#169470 (so far this only happens for codelimit)