* fix(swift): allow Package.resolved pins without a `revision`
The swift manager's Package.resolved Zod schema requires
`state.revision: z.string()` on every pin. That is correct for
source-control pins (`kind: "remoteSourceControl"`), which always
have a git commit SHA, but wrong for SwiftPM Package Registry pins
(`kind: "registry"`) introduced by SE-0292: registry packages are
identified by a version alone and have no revision. As a result,
any Package.resolved that mixes source-control and registry pins
fails `PackageResolvedJson.safeParse`, `updateArtifacts` logs
`swift: could not parse Package.resolved` and returns `null`, and
Renovate silently stops writing lockfile updates on that repository.
This makes `state.revision` optional in the pin schema. The existing
`updateArtifacts` logic already guards the revision-replacement
branch with `if (newRevision)`, so registry pins are still safely
left untouched during source-control dep bumps.
Adds a regression test with a mixed-pins fixture. Before this change
that test panicked at parse time; after the change it demonstrates
the source-control pin gets updated and the registry pin is preserved
without gaining a spurious revision field.
Refs: #41534 (initial Package.resolved support, tested with
source-control pins only), #42303 (from: prefix strip).
* test(manager/swift): address review feedback on mixed-pins test
Per review on the Package.resolved mixed source-control/registry pins
test: inline the fixture into the test body, trim the comment to a
concise regression note, and assert on the parsed JSON with
toMatchObject instead of substring matching.
Co-Authored-By: Claude (Cricut Security policy) <noreply@anthropic.com>
* test(manager/swift): assert full updateArtifacts result for mixed pins
Per review: replace the parse/find/toMatchObject assertions with a
single resolves.toEqual on the whole updateArtifacts result, comparing
against the expected Package.resolved output directly.
Co-Authored-By: Claude (Cricut Security policy) <noreply@anthropic.com>
* test(manager/swift): trim mixed-pins regression comment
Apply review suggestion to shorten the comment to a single line.
Co-Authored-By: Claude (Cricut Security policy) <noreply@anthropic.com>
---------
Co-authored-by: Claude (Cricut Security policy) <noreply@anthropic.com>
* feat(manager/swift): support SSH URLs in Package.swift extraction and artifact matching
Swift packages can use SSH URLs (e.g. `git@github.com:owner/repo.git`) for
dependencies, but the Swift manager only supported HTTPS URLs. This caused
SSH-based dependencies to be silently ignored during extraction, and
Package.resolved pin matching to fail when protocols differed.
- Convert SCP-style SSH and `ssh://` URLs to HTTPS in `parseUrl()` using
the existing `getHttpUrl()` utility before platform detection
- Enhance `normalizeUrl()` in artifacts to use `parseGitUrl()` for
protocol-agnostic URL comparison (falls back to basic normalization
when parsed components are incomplete)
* test(manager/swift): add edge case tests to improve coverage
- Add test for unparseable SSH URL in extraction
- Add test for host-only URL fallback in artifact matching
* fix(manager/swift): remove redundant .git stripping in normalizeUrl
parseGitUrl() already strips the .git suffix from full_name,
so the additional regex replacement is unnecessary.
* test(manager/swift): add ssh:// protocol test for artifact matching
Cover the ssh://git@github.com/... URL format in addition to the
existing git@ SCP-style test for Package.resolved pin matching.
* refactor(manager/swift): use trimTrailingSlash helper in normalizeUrl
* refactor(manager/swift): always normalize URLs in parseUrl
* fix(swift): don't write `from:` range to `Package.resolved`
When a dependency uses a range specifier like `from: "1.0.0"` in
Package.swift, the `newValue` produced by the versioning module contains
the range expression (e.g. `from: "603.0.0"`) rather than a plain version
string. Using `newValue` directly to update `Package.resolved` results in
the lock file containing the range expression instead of a resolved version,
which corrupts it.
Fix by using `dep.newVersion` with the `v` prefix stripped, which is
the actual resolved version and the correct value for `Package.resolved`.
* Update lib/modules/manager/swift/artifacts.ts
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
---------
Co-authored-by: Michael Kriese <michael.kriese@gmx.de>
As noted in #41780, in the case that a `newVersion` has the `v` prefix,
we use that version, which then results in `xcodebuild` failing to build
the project.
We should instead use `newValue`, which does not include the `v` prefix.
To make this clear in our tests, we can align the test data with the
expected input from our Datasources.
Because we need to use the `newVersion` for digest lookups, we need to
make sure that we still require it (or log when it's not found for some
reason).
Co-authored-by: Claude Sonnet 4.6 <jamie.tanna+claude-code@mend.io>
* feat(swift): update Package.resolved when updating Package.swift
Add artifact support to the Swift Package Manager module so that
Package.resolved lockfiles are updated alongside Package.swift manifest
changes. Uses direct JSON modification (targeted regex replacement of
version and revision within each pin block) instead of requiring the
Swift toolchain, avoiding the need for a macOS runner or private repo
authentication.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(swift): achieve 100% coverage for artifacts.ts
Add tests for missing datasource/packageName, missing pins array, and
getDigest exceptions. Mark three unreachable defensive guards with
istanbul ignore (valid JSON always has matching braces and identities).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* refactor(swift): address review feedback from viceice
- Inline test fixtures instead of using fixture files
- Remove unnecessary beforeEach/resetAllMocks
- Use PackageDependency and Upgrade types instead of inline type literals
- Add Zod schema for safe Package.resolved parsing
- Move PackageResolvedPin/PackageResolvedJson types to schema.ts
- Delete fixture files
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Bartosz Dolewski