hbmartin/Swift Package Version Updates
Report available Swift Package Manager dependency updates from Package.swift manifests or Xcode projects
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 18, 2026
- License
- MIT
Pinned Snippet
uses: hbmartin/github-action-spm_version_updates@77ecdd3798d102e93b3b5ab78130e6a740d35ed3 # v2.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| xcode-project-path | Xcode mode: path to the .xcodeproj file. Mutually exclusive with package-manifest-paths and package-resolved-paths-only mode. | no | "" |
| package-manifest-paths | Manifest mode: newline-separated Package.swift paths. Mutually exclusive with xcode-project-path. | no | "" |
| package-resolved-paths | Newline-separated Package.resolved paths. With package-manifest-paths, overrides default adjacent resolved files; alone, activates Package.resolved-only mode. | no | "" |
| check-when-exact | Include exact version constraints when checking for updates | no | false |
| check-branches | Check branch-pinned dependencies for newer commits | no | true |
| check-revisions | Report the latest tagged release for revision-pinned dependencies | no | false |
| report-above-maximum | Also report versions above the maximum allowed constraint range | no | false |
| report-pre-releases | Include pre-release versions when choosing available updates | no | false |
| ignore-repos | Comma-separated repository URLs to skip before any git lookup | no | "" |
| repo-rules-path | Path to a YAML file with per-repository semantic update suppression rules | no | "" |
| allow-hosts | Comma-separated git remote hostnames allowed for version lookups. Empty allows any host for allowed git protocols. | no | "" |
| version-lookup-workers | Maximum concurrent git tag lookups. Must be a positive integer. | no | 4 |
| allow-missing-resolved | When true, missing Package.resolved files are reported as warnings instead of failing the run. | no | false |
| apply-updates | Rewrite supported Package.swift version requirements in the workspace. Manifest mode only; pair with a pull-request creation step. | no | false |
| enrich-release-notes | Fetch GitHub release notes for updated packages and include them in PR comments or tracking issues. | no | true |
| fail-on | Fail when updates are found: true/any for any update, major/minor/patch for semantic updates at or above that severity, or empty/false/none to never fail. | no | "" |
| comment | Post or update the pull request comment. Set false to disable all PR commenting; outputs, the step summary, and annotations are still produced, and a comment left by a prior run is kept as-is rather than deleted. Tracking issues (open-tracking-issue) are unaffected. | no | true |
| comment-on-success | Post an up-to-date pull request comment on clean runs. By default, clean runs delete the prior generated comment instead. | no | false |
| open-tracking-issue | On runs without a pull request context (schedule, workflow_dispatch, push), open or update a single tracking issue with the update report, and close it when everything is up to date. Requires issues: write permission. | no | false |
| cache-version-tags | Cache git tag lookup results with actions/cache to make repeated runs faster | no | true |
| version-tags-cache-ttl | Freshness window, in seconds, for persisted git tag lookups. Must be a non-negative integer; set 0 to disable persistent cache reads and writes. | no | 21600 |
| setup-ruby | Set up Ruby and install this action bundle. Set false only for later invocations in the same job after an earlier invocation has already run setup. | no | true |
| github-token | Token used to create or update pull request comments. Defaults to github.token. | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| updates-found | Number of dependency updates found |
| major-updates-found | Number of major semantic-version updates found |
| minor-updates-found | Number of minor semantic-version updates found |
| patch-updates-found | Number of patch semantic-version updates found |
| parse-warnings | Number of .package(...) declarations that could not be parsed and were skipped. Not counted in updates-found and never fails the run, but skipped declarations are listed in the step summary and PR comment with a link to open an issue — a PR comment is posted even when no updates were found so skips are never silent. |
| missing-resolved | Number of missing Package.resolved files reported when allow-missing-resolved is true |
| applied-updates | Number of Package.swift requirement updates applied when apply-updates is true |
| applied-updates-json | JSON array of applied Package.swift update records. Empty array when apply-updates is false or nothing was applied. |
| updates-json | JSON array of update objects. Each object has a message field and, when available, structured fields such as type, package, repository_url, current_version, available_version, severity, note, source, requirement_kind, package_identity, suggested_command, and suggested_requirement. |
| blocked | Whether the run was blocked before version lookup by a security gate such as allow-hosts |
| error-message | Failure message when blocked is true |
| tracking-issue-number | Number of the tracking issue created or updated, when open-tracking-issue is enabled and the run had no pull request context. Empty otherwise. |
| tracking-issue-url | HTML URL of the tracking issue created or updated. Empty otherwise. |