First analysis

Run three small Swift packages and compare a finding, a control, and an unsupported input. You need the installed CLI and the same terminal with ANALYZER set.

Get the examples#

Download the first-analysis examples. The archive contains authored source only: positive, control, and incomplete packages. It contains no analyzer binary or dependency payload.

curl -fL https://docs.swift-analyzer.com/examples/first-analysis.zip -o first-analysis.zip
unzip first-analysis.zip -d first-analysis

In a local preview, use the download link above from your browser. Markdown and JSON retain the candidate's canonical origin; docs.swift-analyzer.example.invalid is a placeholder, so replace it with the address serving your preview before using a copied download command. Run unzip from the directory containing the downloaded archive.

The positive package deliberately calls a MainActor assertion from a detached task and holds an NSLock guard across suspension. It is analyzed and compiled; its functions and tests are not executed.

Run the positive case#

--allow-build authorizes manifest evaluation, locked dependency retrieval, and a managed indexed build. Use it only for code you intend to build. --include-stdio-rules adds two resource conditions; this example has no stdio observations.

if "$ANALYZER" source-scan \
  --package-path ./first-analysis/positive \
  --product FirstAnalysis \
  --allow-build --include-stdio-rules --format json > positive.json
then
  analysis_status=0
else
  analysis_status=$?
fi
printf 'Analyzer exit: %s\n' "$analysis_status"

Open positive.json. For the recorded profile, the report is degraded, exit 3, with 2 admitted sources and 2 findings: required context lost through detachment (V-EXEC-03) and guard held across suspension (V-ASYNC-14). Unknown observations remain. Timing is written to stderr; it is not part of the JSON document.

Compare the control#

The control removes the detached boundary and releases the guard before await. Run the same command with ./first-analysis/control and control.json in place of the positive paths.

It has 2 admitted sources and 0 findings, but remains degraded with exit 3. Some observations are unknown, and some selected conditions have no observations. Zero findings is not proof that the whole program is safe.

Try the unsupported input#

Run the same command with ./first-analysis/incomplete and incomplete.json. Its package uses a resource-processing form unsupported by this snapshot.

The expected report is unavailable, exit 3, 0 admitted sources, and no executed families. Reasons include unsupported-resource-census:Example and unsupported-resource-rule:Example. This is a refused input, not a clean analysis.

Compare the observed outcomes#

Compare the observed outcomes
Package	Report status	Exit	Admitted sources	Findings
positive	degraded	3	2	2
control	degraded	3	2	0
incomplete	unavailable	3	0	0

These outcomes were reproduced at product 524fa07e on Apple Swift 6.3.3, macOS arm64, on September 11, 2026. Snapshot identities and timings may differ between runs. The source patterns, coverage states and totals above are the checked expectations. Three examples do not measure portfolio-wide precision or recall.

Inspect the complete recorded JSON for the positive case, control, and unsupported input. These are unchanged CLI outputs from that run; their hashes are recorded in the public manifest. They are example evidence, not reports for your project. Compare source anchors and coverage before comparing invocation-specific snapshot identifiers.

Understand the report, then analyze your own SwiftPM product.