cask/audit: disallow new cask to have token in tap_migrations.json

Library/Homebrew/cask/audit.rb

@@ -48,6 +48,7 @@ module Cask
 
     def run!
       check_denylist
+      check_reverse_migration
       check_required_stanzas
       check_version
       check_sha256
@@ -680,12 +681,22 @@ module Cask
     end
 
     def check_denylist
-      return unless cask.tap&.official?
+      return unless cask.tap
+      return unless cask.tap.official?
       return unless reason = Denylist.reason(cask.token)
 
       add_error "#{cask.token} is not allowed: #{reason}"
     end
 
+    def check_reverse_migration
+      return unless new_cask?
+      return unless cask.tap
+      return unless cask.tap.official?
+      return unless cask.tap.tap_migrations.key?(cask.token)
+
+      add_error "#{cask.token} is listed in tap_migrations.json"
+    end
+
     def check_https_availability
       return unless download
 

Library/Homebrew/test/cask/audit_spec.rb

@@ -37,7 +37,6 @@ describe Cask::Audit, :cask do
   let(:token_conflicts) { nil }
   let(:audit) {
     described_class.new(cask, online:          online,
-
                               strict:          strict,
                               new_cask:        new_cask,
                               token_conflicts: token_conflicts)
@@ -315,6 +314,32 @@ describe Cask::Audit, :cask do
           expect(subject).to pass
         end
       end
+
+      context "when cask token is in tap_migrations.json" do
+        let(:cask_token) { "token-migrated" }
+        let(:tap) { Tap.fetch("homebrew/cask") }
+
+        before do
+          allow(tap).to receive(:tap_migrations).and_return({ cask_token => "homebrew/core" })
+          allow(cask).to receive(:tap).and_return(tap)
+        end
+
+        context "and `new_cask` is true" do
+          let(:new_cask) { true }
+
+          it "fails" do
+            expect(subject).to fail_with("#{cask_token} is listed in tap_migrations.json")
+          end
+        end
+
+        context "and `new_cask` is false" do
+          let(:new_cask) { false }
+
+          it "does not fail" do
+            expect(subject).to pass
+          end
+        end
+      end
     end
 
     describe "locale validation" do