The Homebrew formulae, casks, and Mac App Store apps this Mac is rebuilt from, in one Brewfile. The commands to install it are in INSTALL.md.
Entries for one Mac only, such as work or personal apps, go in Brewfile.local next to it. The Brewfile reads that file when it exists, and git ignores it, so those entries are never published.
The Mac has changed, so update the Brewfile. Add --file=Brewfile.local to keep an entry private:
brew bundle cleanup </dev/null # installed, but in neither file
brew bundle check --verbose --no-upgrade # in a file, but not installed
brew bundle add <formula> # or: brew bundle add --cask <cask>
brew bundle remove --formula <formula> # or: brew bundle remove --cask <cask>Or add everything cleanup lists at once. It goes to Brewfile.local, since nothing can tell a private entry from a public one, so move the public ones to the Brewfile after:
brew bundle add --file=Brewfile.local $(brew bundle cleanup --formula </dev/null | grep -Ev '^(Would|Run) ')
brew bundle add --cask --file=Brewfile.local $(brew bundle cleanup --cask </dev/null | grep -Ev '^(Would|Run) ')The Brewfile has changed, so update the Mac:
brew bundle check --verbose --no-upgrade # what is missing
brew bundle install --no-upgrade # install only thatNever run brew bundle dump --force: it rewrites the Brewfile from what is installed and publishes every private entry. App Store apps and the other traps are in INSTALL.md.
Homebrew has no hook that runs after brew install or brew uninstall, and its maintainers have declined to add one. What is left is a brew wrapper, which misses other shells and App Store installs, or a scheduled dump, which needs its own launchd job. Neither is worth the complexity here, so each change is recorded by hand with the commands in INSTALL.md.
brew bundle dump is not used either. It rewrites the whole file from what is installed, so every private entry would land in the public one.