Running Homebrew non-interactively on a build agent: NONINTERACTIVE, env vars and Brewfile

Goal

Install and use Homebrew on a build agent or CI runner without any interactive prompt, and pin down what gets installed.

Prerequisites

Network access to GitHub and Homebrew's bottle hosting. The prefix differs by architecture: /opt/homebrew on Apple silicon, /usr/local on Intel.

Steps

1. Install without any interactive confirmation: NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)".
2. Put brew on PATH for the current and future shells: eval "$(/opt/homebrew/bin/brew shellenv)" (Apple silicon) or eval "$(/usr/local/bin/brew shellenv)" (Intel); add the same line to the runner's shell profile.
3. Stop Homebrew running a full brew update before every single install, which is slow and network-heavy on ephemeral runners: export HOMEBREW_NO_AUTO_UPDATE=1.
4. Opt the runner out of usage analytics: export HOMEBREW_NO_ANALYTICS=1.
5. Make the installed set reproducible: on a reference machine, brew bundle dump --file=Brewfile records what's installed; commit that file, then on a fresh runner brew bundle install --file=Brewfile installs exactly that set.
6. Verify a runner matches the Brewfile without changing anything: brew bundle check --file=Brewfile --no-upgrade, which exits non-zero if something is missing.
7. Stop a formula from being touched by a later brew upgrade: brew pin <formula>; reverse it with brew unpin <formula>.

Expected result

brew bundle check exits 0 on a correctly provisioned runner; brew --prefix prints /opt/homebrew or /usr/local, confirming which tree is active.

Limits and test basis

The non-interactive install variable, the HOMEBREW_NO_* environment variables and the two prefixes are documented in Homebrew's installation documentation and its manpage; brew bundle and the Brewfile format are documented separately. NONINTERACTIVE=1 removes confirmation prompts but not the need for write access to the prefix directory; run the install as the account that will own the prefix, not as root. No reboot or re-login is needed for any of these steps; a fresh shell only needs the shellenv line sourced again (or the profile change picked up) to see brew on PATH. To undo a bad Brewfile run, brew bundle cleanup --file=Brewfile (with --force to actually remove) uninstalls anything present that the Brewfile does not list, bringing the runner back in line with what is declared.