Analyze a SwiftPM project

Analyze a selected library or executable product through the bounded compiler-backed source-scan workflow. Start with the first analysis to verify your setup.

Select a supported product#

Use a SwiftPM directory containing Package.swift. Choose the exact product name from that manifest. The documented snapshot limits discovery to 16 sources and 16 modules, with additional resource, header, byte and acquisition limits. Large applications and this analyzer's full repository do not fit this envelope.

Filesystem and locked Git dependency closures can be discovered within those limits. Native source inputs can be captured, but their effects remain unknown; capture alone does not add native semantic rule coverage. Resource-processing forms, generated sources, plugins, conditional settings or toolchain mismatches can make an input unavailable. Consult Supported environments and the actual reason list.

Authorize the build#

In the command below, replace /path/to/package with your package directory and YourProduct with its product name. ANALYZER is set during installation.

"$ANALYZER" source-scan \
  --package-path /path/to/package \
  --product YourProduct \
  --allow-build --format json > analysis.json

This evaluates the manifest, may fetch locked Git dependencies, and performs a managed indexed build. It does not run analyzed functions or package tests. The command uses temporary acquisition work and cleans up its owned temporary directory; it is not an API for exporting a reusable manifest bundle.

Add stdio checks explicitly#

Add --include-stdio-rules to select LIFE-09 and LIFE-10 for recognized stdio resource patterns. Selection increases requested conditions from 9 to 11. It does not establish that your file handles, wrappers or aliases are supported.

Inspect coverage before acting#

Keep stdout JSON, stderr and the process exit code. Check status, reasons, admittedSourceCount, each condition's executed and coverage fields, and its observations. Read Understand results before interpreting zero findings or integrating advisory CI.