Non-experimental Swift analysis?

[jzilske]

The Swift analyzers have been designated as experimental since their introduction afaict, i.e. they require the enableExperimental command line argument (see also here). Are there plans to drop that requirement?

[nhumblot]

Hi! 👋

Thank you for your question!

It appears we do not have a policy to decide when its time to remove an experimental status on an analyzer. Since the introduction of the experimental flag, only a few analyzers went into stable status.

The 3 analyzers do not have any setup requirements so it looks like we could do this change in a minor version change. It seems there are no open bugs on them.

If we extend it in general to set some criteria on how to move an analyzer out of experimental status, here are the things I would propose to consider:

1. Check if it works well in the various Swift projects versions => These analyzers did not receive many updates
2. Absence of open bugs => none seems to relate to them right now
3. False Positive/False Negative Rates => identify Swift open-source projects we can test OWASP Dependency-Check on
4. Test Coverage => Looking if edge cases are covered
5. Production Experience => Gather feedback from users who enabled the analyzer on their project, check if we got metric on Swift analyzers usage