{"schemaVersion":"2.0.0","locale":"en","title":"Analyze a SwiftPM project","description":"Analyze a selected library or executable product through the bounded compiler-backed source-scan workflow. Start with the first analysis to verify your setup.","htmlUrl":"https://docs.swift-analyzer.com/guides/swiftpm/","markdownUrl":"https://docs.swift-analyzer.com/guides/swiftpm/index.md","productRevision":"524fa07e0ae4153c84ac12ae9eb6559df89ec2be","catalogRevision":"4558458d","docsRevision":"1f17ba58ab08627e0de898f1442067b09e960b48cd5605d6529e9275f8930d68","channel":"pre-prod","maturity":"experimental","access":"owner-provided-checkout","markdown":"# Analyze a SwiftPM project\n\nAnalyze a selected library or executable product through the bounded compiler-backed source-scan workflow. Start with the [first analysis](https://docs.swift-analyzer.com/get-started/first-analysis/) to verify your setup.\n\n## Select a supported product\n\nUse a SwiftPM directory containing `Package.swift`. Choose the exact product name from that manifest. The documented snapshot limits discovery to 16 sources and 16 modules, with additional resource, header, byte and acquisition limits. Large applications and this analyzer's full repository do not fit this envelope.\n\nFilesystem and locked Git dependency closures can be discovered within those limits. Native source inputs can be captured, but their effects remain unknown; capture alone does not add native semantic rule coverage. Resource-processing forms, generated sources, plugins, conditional settings or toolchain mismatches can make an input unavailable. Consult [Supported environments](https://docs.swift-analyzer.com/reference/environments/) and the actual reason list.\n\n## Authorize the build\n\nIn the command below, replace `/path/to/package` with your package directory and `YourProduct` with its product name. `ANALYZER` is set during installation.\n\n```sh\n\"$ANALYZER\" source-scan \\\n  --package-path /path/to/package \\\n  --product YourProduct \\\n  --allow-build --format json > analysis.json\n```\n\nThis evaluates the manifest, may fetch locked Git dependencies, and performs a managed indexed build. It does not run analyzed functions or package tests. The command uses temporary acquisition work and cleans up its owned temporary directory; it is not an API for exporting a reusable manifest bundle.\n\n## Add stdio checks explicitly\n\nAdd `--include-stdio-rules` to select LIFE-09 and LIFE-10 for recognized stdio resource patterns. Selection increases requested conditions from 9 to 11. It does not establish that your file handles, wrappers or aliases are supported.\n\n## Inspect coverage before acting\n\nKeep stdout JSON, stderr and the process exit code. Check `status`, `reasons`, `admittedSourceCount`, each condition's `executed` and `coverage` fields, and its observations. Read [Understand results](https://docs.swift-analyzer.com/guides/results/) before interpreting zero findings or integrating [advisory CI](https://docs.swift-analyzer.com/guides/ci/).\n","anchors":["analyze-a-swiftpm-project","select-a-supported-product","authorize-the-build","add-stdio-checks-explicitly","inspect-coverage-before-acting"]}