cask audit: check for appcast if the cask uses github releases

Library/Homebrew/cask/lib/hbc/audit.rb

@@ -34,6 +34,7 @@ module Hbc
       check_single_pre_postflight
       check_single_uninstall_zap
       check_untrusted_pkg
+      check_github_releases_appcast
       self
     rescue StandardError => e
       odebug "#{e.message}\n#{e.backtrace.join("\n")}"
@@ -227,6 +228,13 @@ module Hbc
       end
     end
 
+    def check_github_releases_appcast
+      return if cask.appcast
+      return unless cask.url.to_s =~ %r{github.com/([^/]+)/([^/]+)/releases/download/(\S+)}
+
+      add_warning "Cask uses GitHub releases, please add an appcast. See https://github.com/caskroom/homebrew-cask/blob/master/doc/cask_language_reference/stanzas/appcast.md"
+    end
+
     def check_url
       return unless cask.url
       check_download_url_format

Library/Homebrew/test/cask/audit_spec.rb

@@ -368,6 +368,25 @@ describe Hbc::Audit, :cask do
       end
     end
 
+    describe "GitHub releases appcast check" do
+      let(:error_msg) { /Cask uses GitHub releases/ }
+
+      context "when the Cask does not use GitHub releases" do
+        let(:cask_token) { "basic-cask" }
+        it { should_not warn_with(error_msg) }
+      end
+
+      context "when the Cask uses GitHub releases and has an appcast" do
+        let(:cask_token) { "github-with-appcast" }
+        it { should_not warn_with(error_msg) }
+      end
+
+      context "when the Cask uses GitHub releases and does not have an appcast" do
+        let(:cask_token) { "github-without-appcast" }
+        it { is_expected.to warn_with(error_msg) }
+      end
+    end
+
     describe "preferred download URL formats" do
       let(:warning_msg) { /URL format incorrect/ }
 

Library/Homebrew/test/support/fixtures/cask/Casks/github-with-appcast.rb

@@ -0,0 +1,14 @@
+cask 'github-with-appcast' do
+  version '1.0'
+  sha256 'a69e7357bea014f4c14ac9699274f559086844ffa46563c4619bf1addfd72ad9'
+
+  url "https://github.com/user/project/releases/download/#{version}/github.pkg"
+  appcast 'https://github.com/user/project/releases.atom',
+          checkpoint: '56d1707d3065bf0c75d75d7738571285273b7bf366d8f0f5a53eb8b457ad2453'
+  name 'github'
+  homepage 'https://github.com/user/project'
+
+  pkg 'github.pkg'
+
+  uninstall pkgutil: 'com.github'
+end

Library/Homebrew/test/support/fixtures/cask/Casks/github-without-appcast.rb

@@ -0,0 +1,12 @@
+cask 'github-without-appcast' do
+  version '1.0'
+  sha256 'a69e7357bea014f4c14ac9699274f559086844ffa46563c4619bf1addfd72ad9'
+
+  url "https://github.com/user/project/releases/download/#{version}/github.pkg"
+  name 'github'
+  homepage 'https://github.com/user/project'
+
+  pkg 'github.pkg'
+
+  uninstall pkgutil: 'com.github'
+end