feat: Add Swift FileParser support for Xcode-managed SwiftPM projects

[markhallen]

What are you trying to accomplish?

This is Part 2 of adding Xcode SwiftPM support, building on the FileFetcher work in #14332. It extends the Swift FileParser to parse dependencies from Xcode-managed SwiftPM projects that don't have a Package.swift file.

Many iOS/macOS projects use Xcode's built-in SwiftPM integration, where dependency pins are stored in Package.resolved (inside .xcodeproj/project.xcworkspace/xcshareddata/swiftpm/) and version requirements are declared as XCRemoteSwiftPackageReference entries in project.pbxproj. This change teaches the FileParser to extract Dependabot::Dependency objects from those files.

Relates to #7694

Anything you want to highlight for special attention from reviewers?

• Feature flag gated: All new parsing logic is behind Dependabot::Experiments.enabled?(:enable_swift_xcode_spm) — when disabled, the FileParser behaves identically to before.

• Dual-mode parsing: The parse method detects whether the project is classic SPM (has Package.swift) or Xcode SPM (has Package.resolved inside .xcodeproj but no Package.swift), and dispatches accordingly. When both exist, classic SPM mode takes precedence.

• PackageResolvedParser: New helper that parses Package.resolved v1, v2, and v3 schemas into Dependabot::Dependency objects. Each schema version has a different JSON structure:

  • v1: object.pins with package, repositoryURL, state.version
  • v2: top-level pins with identity, location, state.version
  • v3: same as v2 but with additional originHash field

  Raises DependencyFileNotParseable for invalid JSON, unsupported schema versions, or missing pin data.

• PbxprojParser: New helper that uses regex to extract XCRemoteSwiftPackageReference entries from project.pbxproj files. Supports all Xcode requirement kinds: upToNextMajorVersion, upToNextMinorVersion, exactVersion, versionRange, branch, and revision. These are mapped to NativeRequirement strings that the Swift UpdateChecker can process.

• Requirement enrichment: Dependencies from Package.resolved are enriched with requirement info from matching project.pbxproj entries. The enrichment matches by normalized dependency name (derived from the repository URL). If no project.pbxproj is available (e.g. wasn't fetched), the dependency is still created with a nil requirement.

• Multiple .xcodeproj support: When a repo contains multiple Xcode projects (each with their own Package.resolved), the parser processes each one independently and merges results via DependencySet.

How will you know you've accomplished your goal?

• 140/140 RSpec examples pass across the full Swift test suite with zero failures.
• 56 new tests covering all three parser files:
  • PackageResolvedParser: 15 examples covering v1/v2/v3 schemas, revision-only pins, multiple dependencies, empty pins, invalid JSON, unknown schema, SCP-style URLs
  • PbxprojParser: 10 examples covering all requirement kinds (major, minor, exact, range, branch, revision), multiple entries, empty/nil content
  • FileParser integration: 31 examples (12 existing + 19 new) covering single v2 project, v1 project, v3 project, multi-requirement types, multiple xcodeproj directories, revision-only, no pbxproj, invalid JSON, unknown schema, empty pins, both Package.swift and xcodeproj present, and flag-disabled behavior
• RuboCop passes with no offenses (36 files inspected).
• All existing classic SPM tests continue to pass unchanged.
• 7 new fixture projects exercise the full range of Package.resolved schemas and pbxproj requirement types.

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[thavaahariharangit]

LGTM

The base branch was changed.

[Copilot]

Pull request overview

Adds Swift FileParser support for Xcode-managed SwiftPM projects (no Package.swift) by parsing .xcodeproj-scoped Package.resolved and enriching dependencies with version constraints extracted from project.pbxproj, gated behind :enable_swift_xcode_spm.

Changes:

• Extend Dependabot::Swift::FileParser to dispatch between classic SPM parsing and Xcode SwiftPM parsing (feature-flagged).
• Add PackageResolvedParser (v1/v2/v3) and PbxprojParser helpers plus shared URL normalization (UrlHelpers).
• Add fixtures and RSpec coverage for schema variants, requirement kinds, multi-project repos, and error cases.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
swift/lib/dependabot/swift/file_parser.rb	Adds Xcode SPM parsing path + feature-flag gating and requirement enrichment logic
swift/lib/dependabot/swift/file_parser/package_resolved_parser.rb	Parses Xcode Package.resolved schemas into Dependabot::Dependency objects
swift/lib/dependabot/swift/file_parser/pbxproj_parser.rb	Extracts Xcode XCRemoteSwiftPackageReference requirements from project.pbxproj
swift/lib/dependabot/swift/url_helpers.rb	Centralizes URL→dependency-name normalization used by multiple parsers
swift/lib/dependabot/swift/file_parser/dependency_parser.rb	Switches dependency name normalization to the shared UrlHelpers
swift/spec/dependabot/swift/file_parser_spec.rb	Integration specs for Xcode SPM parsing and flag-disabled behavior
swift/spec/dependabot/swift/file_parser/package_resolved_parser_spec.rb	Unit specs for v1/v2/v3 schemas + invalid/unknown schema handling
swift/spec/dependabot/swift/file_parser/pbxproj_parser_spec.rb	Unit specs for requirement kinds and edge cases
swift/spec/fixtures/projects/**	Fixture Xcode projects for schema/requirement permutations and failure cases

Comments suppressed due to low confidence (1)

swift/lib/dependabot/swift/file_parser.rb:186

• The experiment-enabled required-file check here only accepts Package.resolved paths that include .xcodeproj/, but Dependabot::Swift::FileFetcher.required_files_in? currently treats any Package.resolved as sufficient when the experiment is enabled. This mismatch can lead to repos passing file fetching validation but failing in the parser with a missing-files error. Consider aligning this check with the fetcher’s criteria (or tightening the fetcher) so validation behavior is consistent across the Swift ecosystem.

        if Dependabot::Experiments.enabled?(:enable_swift_xcode_spm)
          return if dependency_files.any? { |f| f.name.end_with?("Package.resolved") && f.name.include?(".xcodeproj/") }

          raise "No Package.swift or Xcode Package.resolved found!"
        end