• [x] Have you followed our Contributing guidelines?


• [x] Have you checked for other open Pull Requests for the same change?


• [x] Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.


• [x] Have you explained why you'd like these changes included, not just what they do?


• [x] For bug fixes, have you given step-by-step brew commands to reproduce the bug?


• [x] Have you written new tests (excluding integration tests)? Here's an example.


• [x] Have you successfully run brew lgtm (style, typechecking and tests) locally?

• [x] I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

AI-assisted: Claude Code (Claude Opus 5) diagnosed the bug and wrote the code and spec; I reviewed the diff, and ran brew lgtm and the manual reproduction below myself.

brew upgrade --fetch-HEAD <formula> reports already installed for a HEAD install even when upstream has newer commits, whenever the GitHub API request fails (e.g. the anonymous per-IP rate limit).

Reproduce (with a rate-limited or otherwise failing GitHub API, and an installed HEAD older than upstream):

$ brew install --HEAD tmux                 # some time ago

$ git ls-remote https://github.com/tmux/tmux.git master   # newer commit than installed

$ brew upgrade --fetch-HEAD tmux

Warning: tmux HEAD-40381bd already installed

Cause: GitHubGitDownloadStrategy#last_commit falls back to super (git rev-parse HEAD on the cached, un-fetched clone) when GitHub.last_commit returns nil. commit_outdated? only fetches when last_commit is blank, so it compared the installed commit against the stale clone and reported it as current.

Fix:
- commit_outdated? now falls back to fetch_last_commit (a real git fetch) when the API can't tell us the latest commit.
- GitHub.last_commit / multiple_short_commits_exist? now send the same Authorization header as open_rest (env token → gh auth token → keychain), so they aren't subject to the anonymous rate limit in the first place. Extracted API.credentials_curl_args for this and reused it in open_rest.

New spec fails on the old code and passes with the fix.

🤖 Generated with Claude Code