CodeQL + Dependabot

[MarcoEidinger]

Swift is now supported for the following GitHub tools:

• CodeQL: semantic code analysis to detect security vulnerabilities
• Dependabot: security alerts and dependency updates

I wrote about my first experience trying out the recent updates for Swift developers by GitHub. Still early but

I am curious if Dave or Sven plan to migrate to Dependabot.

[daveverwer]

Thanks for the mention in the article! We have opted in (or rather not opted out of) Dependabot security updates but are still using your swift-package-dependencies-check for now. The Dependabot one looks good, although I think we'd wait for the versioning strategies you mention.

I'd love to put CodeQL on the project, but as we upgrade our base Swift version very close to the betas so that we can analyse packages using the latest tools version, we're ahead of the CodeQL supported version. I believe they do now support 5.8, but our base image is already on 5.9.

[MarcoEidinger]

Thanks @daveverwer for the insights. Very interesting to learn about the reasonings and very understandable. No worries, I'll continue to maintain swift-package-dependencies-check. Let me know if anything is needed along the way. Pretty interesting to see where Depandabot ends up with versioning strategies for Swift.

FYI: there is also a feature request to support Xcode projects