Support for Swift package manager

[deivid-rodriguez]

This PR implements #1245.

For now just a draft but most of the functionality I intend to ship initially should be already there.

[deivid-rodriguez]

One question for @stevapple (maybe @0xTim knows too?).

So, our updater runs under Linux, and since we're running Swift directly, I've encountered a problem where we're adding Linux specific dependencies to some manifests.

For example, whenever we find this dependency.

Can you think of any workaround? I was thinking we could maybe ask upstream for some feature that allows to resolve under a specific platform, like swift package update --platform macOS or something. But regardless of that, it'd be nice to figure out a way to somehow override this #if os() macro.

That said, what I've been able to see from some forum research is that this may be an old hack and not what's recommended right now. Maybe the right way now is conditional dependencies. If that's the case, maybe it's best to let libraries using this old hack fix themselves.

[stevapple]

The only way to deal with such hack is to syntactically parse the file with SwiftSyntax, IIRC. It’s hard and not worth the effort.
Some packages may rely on this hack because their dependencies used it and some because they’re directly using platform-specific APIs in the manifest, so removing or bypassing can be likely breaking.

I would suggest to leave it alone and let the library author fix it. These packages are also not likely to have Package.resolved committed, because it could differ from platform to platform.

I've encountered a problem where we're adding Linux specific dependencies to some manifests.

I don’t think it’s a big problem… SwiftPM will remove unnecessary packages and add necessary ones during resolution.

[deivid-rodriguez]

Thanks for the input, that's reassuring!

[deivid-rodriguez]

Not fully done yet, but happy to get some early feedback here!

[deivid-rodriguez]

In order to keep this PR smaller and easier to review, I removed Security Update support and versioning strategies from this initial PR. Will pull those changes later.

Unless CI proves me wrong, this should be ready for a review now!

[jakecoffman]

Looks good, maybe we can start some smoke tests too? 👏

[deivid-rodriguez]

Yes, I'll create some smoke tests tomorrow!

[deivid-rodriguez]

Smoke test created at dependabot/smoke-tests#106.

My understanding is that we need to merge this and let an initial updater image for Swift be published so that the smoke test can pass.

EDIT: And also a new release of https://github.com/dependabot/cli that supports pulling the swift updater.

[deivid-rodriguez]

CLI with support for pulling the Swift updater has been released.

Once CI is green, I'll deploy this change, and then see if the smoke tests pass.

[deivid-rodriguez]

Actually I just pushed a small trick to verify smoke tests before merging.

[deivid-rodriguez]

The smoke test is passing now! And it actually detected a real issue! I will next merge the smoke test PR, regenerate smoke tests cache, and then edit this PR to run against the default branch of the smoke tests repo.