PkgLift v0.4.0

PkgLift 0.4.0 makes a narrow class of external Git pods more explainable—without making them automatic.

What’s new

• Typed Git provenance. PkgLift can now record source evidence for supported literal :git declarations in a Podfile.
• Podfile and lockfile reconciliation. It compares the declaration with CocoaPods EXTERNAL SOURCES and CHECKOUT OPTIONS evidence without executing Ruby or contacting the source repository.
• Sensitive URL data removed. URL user information, credentials, queries, and fragments are stripped before provenance reaches standard or portable JSON.
• Fail-closed preflight. Changed, lossy, incomplete, conflicting, credential-bearing, or otherwise unsafe external evidence is refused before project files are written.
• Real-project refusal evidence. The pinned, read-only XcodeBenchmark and Hammerspoon pilots now assert unpinned and incomplete-tag Git cases with a complete no-AUTO result.

The safety boundary is unchanged

External Git sources are never classified as AUTO in 0.4.0. They remain REVIEW, BLOCKED, or UNKNOWN until a separately reviewed migration path has enough evidence to be safe.

Local :path dependencies, private authentication, network repository resolution, Podspec generation, and automatic migration of external sources remain intentionally deferred.

Upgrade

brew upgrade pkglift
pkglift version

New users can install with:

brew install Alexsvensson99/tap/pkglift

• Full v0.4.0 release notes
• Pinned, read-only pilot evidence
• Full changelog from v0.3.0

PkgLift v0.3.0

What's Changed

• Bump github.com/tuist/xcodeproj from 9.15.0 to 9.15.1 in the swift-dependencies group by @dependabot[bot] in #45
• Bump the github-actions group with 3 updates by @dependabot[bot] in #46
• docs: clarify project roadmap by @Alexsvensson99 in #49
• feat: broaden safe CocoaPods migration coverage by @Alexsvensson99 in #50
• release: prepare PkgLift 0.3.0 by @Alexsvensson99 in #51
• release: publish reviewed v0.3.0 manifest by @Alexsvensson99 in #52

New Contributors

• @dependabot[bot] made their first contribution in #45

Full Changelog: v0.2.1...v0.3.0

PkgLift v0.2.1

What's Changed

• Add an SEO-focused GitHub Pages site by @Alexsvensson99 in #39
• Link the live PkgLift website from the README by @Alexsvensson99 in #40
• Use the deployed custom domain for Pages metadata by @Alexsvensson99 in #41
• Harden AUTO with Podfile provenance by @Alexsvensson99 in #42
• Resolve Xcode environments deterministically by @Alexsvensson99 in #43
• Prepare PkgLift 0.2.1 by @Alexsvensson99 in #44
• Publish PkgLift 0.2.1 through reviewed manifest by @Alexsvensson99 in #47

Full Changelog: v0.2.0...v0.2.1

PkgLift v0.2.0

What's Changed

• Run one-time repository maintenance by @Alexsvensson99 in #9
• Complete one-time repository maintenance by @Alexsvensson99 in #10
• Remove temporary repository maintenance workflow by @Alexsvensson99 in #11
• Improve real-world testing and contributor onboarding by @Alexsvensson99 in #12
• Harden and de-duplicate pull request CI by @Alexsvensson99 in #27
• Improve README onboarding and migration reporting by @Alexsvensson99 in #28
• Add safe recursive project and workspace discovery by @Alexsvensson99 in #29
• Add pinned real-project pilot validation by @Alexsvensson99 in #30
• Support literal string and symbol CocoaPods target syntax by @Alexsvensson99 in #31
• Add explicit build destination and configuration overrides by @Alexsvensson99 in #32
• Add privacy-preserving local diagnostics reports by @Alexsvensson99 in #33
• Pass the selected scheme to workspace package resolution by @Alexsvensson99 in #36
• Add a positive end-to-end migration and build pilot by @Alexsvensson99 in #34
• Prepare PkgLift v0.2.0 by @Alexsvensson99 in #37
• Publish v0.2.0 through a reviewed release manifest by @Alexsvensson99 in #38

Full Changelog: v0.1.2...v0.2.0

v0.1.2

What's Changed

• Close v0.1.1 changelog by @Alexsvensson99 in #6
• Require verified SwiftPM minimum versions by @Alexsvensson99 in #7

Full Changelog: v0.1.1...v0.1.2

v0.1.1

What's Changed

• Prepare signed v0.1.1 distribution by @Alexsvensson99 in #3
• Handle standalone CLI Gatekeeper semantics by @Alexsvensson99 in #4
• Verify extracted release signature metadata by @Alexsvensson99 in #5

Full Changelog: v0.1.0...v0.1.1

PkgLift v0.1.0

PkgLift v0.1.0 is the first public release of a conservative CocoaPods-to-SwiftPM migration CLI for Apple projects.

Highlights

• Analyze CocoaPods dependencies and existing Xcode targets without evaluating Ruby.
• Generate reviewable migration plans with AUTO, REVIEW, BLOCKED, and UNKNOWN classifications.
• Apply only fully evidenced AUTO migrations with clean-Git enforcement, backups, atomic rollback, and typed errors.
• Add exact SwiftPM package and product references through the Xcode project model.
• Preserve unknown pods, target blocks, unrelated Ruby, and remaining CocoaPods integration.
• Structurally verify project parsing, package references, product links, and migrated Podfile declarations.
• Validate the bundled registry of 10 verified mappings.

Install on Apple Silicon

Download both release assets, then run:

shasum -a 256 -c pkglift-macos-arm64.tar.gz.sha256
tar -xzf pkglift-macos-arm64.tar.gz
sudo mkdir -p /usr/local/libexec/pkglift /usr/local/bin
sudo cp pkglift /usr/local/libexec/pkglift/
sudo cp -R PkgLift_PkgLiftRegistry.bundle /usr/local/libexec/pkglift/
sudo ln -sf /usr/local/libexec/pkglift/pkglift /usr/local/bin/pkglift

Archive SHA-256:

4bae076b56d788413b6feaa65b0ec7e9b8f8567ed1f29e8cdfd3da858023d1c1

Verification

• 74 automated tests passed: 69 XCTest and 5 Swift Testing tests.
• Build, Test, Registry Validation, and final Release workflows passed on commit 320c8cb.
• The downloaded public archive passed checksum, arm64, direct-execution, and symlink-installation smoke tests.
• A missing registry bundle returns a typed error with exit code 1 instead of trapping.
• A representative real Capacitor/CocoaPods project pilot produced zero unsafe AUTO migrations and no project mutation.

v0.1.0 limitations

• Release binary targets Apple Silicon and macOS 14 or later.
• Only CocoaPods-to-SwiftPM migrations are supported.
• Automatic migration requires a verified registry mapping, a lockfile-backed semantic version, and exactly one destination target.
• Dynamic Ruby, hooks, external pod sources, ambiguous targets, and unsupported configurations remain manual-review cases.
• PkgLift does not run pod install automatically.

Release hardening

• Package registry resources with the release binary
• Resolve registry resources beside symlink targets

v0.1.0-rc.3

What's Changed

• Resolve registry bundle beside symlink targets by @Alexsvensson99 in #2

Full Changelog: v0.1.0-rc.2...v0.1.0-rc.3

v0.1.0-rc.2 (superseded)

Warning

Superseded by v0.1.0-rc.3.
RC2 works when run directly from the extracted archive, but the documented symlink installation cannot locate the bundled registry. Use RC3 instead.

What's Changed

• Package registry resources with release binary by @Alexsvensson99 in #1

New Contributors

• @Alexsvensson99 made their first contribution in #1

Full Changelog: v0.1.0-rc.1...v0.1.0-rc.2

v0.1.0-rc.1

Full Changelog: https://github.com/Alexsvensson99/PkgLift/commits/v0.1.0-rc.1