Using custom taps for pinning dependencies

[Kentzo]

Output of brew config

N/A

Output of brew doctor

N/A

Description of issue

I'm planning to use Homebrew a source of tooling and libraries used in my build workflow. For the sake of repeatable builds I'd like to pin these dependencies.

It's my understanding that I'm expected to create a new tap and then use brew extract to populate it with pinned dependencies I require. However, there are a few obstacles I'm not sure how to overcome:

1. Taps seems to require a separate git repository. This is redundant in my case as I'd prefer to keep the tap as a directory as part of my project repository. Is there a way to brew tap a non-git local directory?
2. It seems that brew tries to maintain the most recent version of the tap. This does not fit my workflow as I typically want to be in control when matching revisions of the tap to revisions of my project. Installing most recent taps for a 2y old project tag doesn't make much sense. Is there a way to "pin" tap to a specific tag and/or branch?
3. Does Homebrew archives all the bottles it ever ships? If not, is there a way to extract a bottle alongside the formula into a custom tap in a way that brew install will respect it?

Please let me know if there is an alternative approach to my goals.

[SMillerDev]

This approach seems to run counter to most things Homebrew seems to do so I expect it won't work very well. This sounds like the type of scenario people normally use an immutable docker image for.

Is there a way to brew tap a non-git local directory?

No, brew exclusively uses git repos for this

Is there a way to "pin" tap to a specific tag and/or branch?

There is not, though you could probably manipulate the git repo after tapping.

Does Homebrew archives all the bottles it ever ships?

Not guaranteed

If not, is there a way to extract a bottle alongside the formula into a custom tap in a way that brew install will respect it?

You can host your own bottles

[Kentzo]

This sounds like the type of scenario people normally use an immutable docker image for.

It's a project for Apple platforms.

I think can work around [2] by using formula@version so that even the most recent commit of the tap will have the oldest dependency.

You can host your own bottles

As in manually edit the formula to point to my own archive? Yeah, should work.

[Kentzo]

@SMillerDev A side question: is it possible to constraint brew install to a particular tap? I untapped homebrew/core, but brew install still pulls formulare from there.

Nvm, I can just prepend user/repo to all depends_on clauses of my pinned formulae.