Merge pull request #8470 from dtrodrigues/sha-tag

audit: don't allow both sha256 and tag/revision for formula

Library/Homebrew/rubocops/components_redundancy.rb

@@ -19,6 +19,19 @@ module RuboCop
         STABLE_MSG = "`stable do` should not be present without a `head` or `devel` spec"
 
         def audit_formula(_node, _class_node, _parent_class_node, body_node)
+          urls = find_method_calls_by_name(body_node, :url)
+
+          urls.each do |url|
+            url.arguments.each do |arg|
+              next if arg.class != RuboCop::AST::HashNode
+
+              url_args = arg.keys.each.map(&:value)
+              if method_called?(body_node, :sha256) && url_args.include?(:tag) && url_args.include?(:revision)
+                problem "Do not use both sha256 and tag/revision."
+              end
+            end
+          end
+
           stable_block = find_block(body_node, :stable)
           if stable_block
             [:url, :sha256, :mirror].each do |method_name|