feat: Extend Swift FileFetcher for Xcode-managed SwiftPM (.xcodeproj) support

[markhallen]

What are you trying to accomplish?

This adds support for discovering Swift Package Manager dependencies managed through Xcode projects (.xcodeproj), behind the :enable_swift_xcode_spm feature flag.

Currently, the Swift FileFetcher only supports repos with a top-level Package.swift manifest. Many iOS/macOS projects use Xcode's built-in SwiftPM integration instead, where dependency pins live at .xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved and package references are declared in project.pbxproj. This change allows Dependabot to discover and fetch those files.

Relates to #7694

Anything you want to highlight for special attention from reviewers?

• Feature flag gated: All new behavior is behind Dependabot::Experiments.enabled?(:enable_swift_xcode_spm). When disabled, the FileFetcher behaves identically to before.
• package_manifest changed from fetch_file_from_host to fetch_file_if_present: This is necessary so that repos without Package.swift don't raise immediately. The base class validation (required_files_in?) still catches repos that have neither Package.swift nor a valid .xcodeproj.
• Memoization fix: package_resolved was using = instead of ||= — fixed as part of this PR (pre-existing bug).
• Recursive directory scanning: scan_for_xcodeproj_dirs walks the repo tree up to 10 levels deep, skipping directories like .git, .build, Pods, node_modules, and vendor that are unlikely to contain Xcode projects.
• project.pbxproj fetched as support file: It's needed for future parsing of XCRemoteSwiftPackageReference entries but isn't a primary dependency file.
• Validation requires Package.resolved: A .xcodeproj without a Package.resolved is not considered valid — there are no dependency pins to work with.

How will you know you've accomplished your goal?

• 15 RSpec examples pass covering all scenarios: single/multiple/nested .xcodeproj, coexistence with Package.swift, missing Package.resolved, and flag-disabled behavior.
• RuboCop passes with no offenses.
• The shared "a dependency file fetcher" examples continue to pass, confirming no new public instance methods were added.
• When the flag is disabled, the FileFetcher behaves exactly as before (verified by existing tests passing unchanged).

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

Adds experimental Swift FileFetcher support to discover Xcode-managed SwiftPM dependency files (inside .xcodeproj bundles) when :enable_swift_xcode_spm is enabled, while keeping the classic Package.swift flow intact.

Changes:

• Extend Swift FileFetcher to (optionally) scan for .xcodeproj directories and fetch project.pbxproj (support file) plus the Xcode SwiftPM Package.resolved.
• Update Swift FileFetcher behavior to not immediately error when Package.swift is absent (so Xcode-only repos can be inspected under the flag).
• Add RSpec coverage and fixtures for single/multiple/nested .xcodeproj scenarios and mixed repos.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
swift/lib/dependabot/swift/file_fetcher.rb	Adds feature-flagged .xcodeproj discovery + fetch logic, plus required-files logic updates and a memoization fix.
swift/spec/dependabot/swift/file_fetcher_spec.rb	Adds test coverage for flag-enabled/disabled behavior and various .xcodeproj layouts.
swift/spec/fixtures/projects/xcode_project_with_manifest/*	Fixture repo containing both classic Package.swift + Package.resolved and an .xcodeproj SwiftPM resolved file.
swift/spec/fixtures/projects/xcode_project/*	Fixture repo containing an .xcodeproj with project.pbxproj and Xcode SwiftPM Package.resolved.
swift/spec/fixtures/projects/xcode_project_multiple/*	Fixture repo with multiple .xcodeproj directories each containing SwiftPM resolved/pbxproj files.
swift/spec/fixtures/projects/xcode_project_nested/*	Fixture repo with a nested .xcodeproj SwiftPM resolved/pbxproj under a subdirectory.
swift/spec/fixtures/projects/xcode_project_no_resolved/*	Fixture repo with .xcodeproj but no SwiftPM Package.resolved (invalid case).

Comments suppressed due to low confidence (1)

swift/lib/dependabot/swift/file_fetcher.rb:54

• The comment about the base class validating against required_files_in? is a bit misleading: Dependabot::FileFetchers::Base#files raises DependencyFileNotFound early when fetch_files returns an empty array, before calling required_files_in?. Consider updating/removing this comment or raising a more specific error from here when neither Package.swift nor any Xcode SwiftPM files are found.

        # Base class validates returned files against required_files_in? and raises if needed
        return fetched_files unless Dependabot::Experiments.enabled?(:enable_swift_xcode_spm)

[AbhishekBhaskar]

LGTM