1
Analyze
Discover nested projects, workspaces, Podfiles, targets, and locked dependency versions.
CocoaPods → Swift Package Manager
Move dependencies.
Keep the certainty.
PkgLift analyzes native Xcode projects, creates a reviewable migration plan, and applies only dependency changes backed by exact evidence.
brew install Alexsvensson99/tap/pkgliftApple Silicon · macOS 14 or later · MIT licensed
$ pkglift analyze Scanning MyApp.xcworkspace… Found 3 direct CocoaPods dependencies. $ pkglift plan AUTO Alamofire 5.9.1 exact mapping + supported lockfile version REVIEW LegacyAnalytics external source requires human review UNKNOWN InternalUI no exact registry evidence Plan saved to .pkglift/plan.json $ pkglift migrate Dry run complete. No project files changed. $ pkglift migrate --apply Applied 1 reviewed AUTO migration. Preserved 2 CocoaPods dependencies. $ pkglift verify --build --scheme MyApp ✓ package linkage ✓ SwiftPM resolution ✓ Xcode build
Dry-run firstPreview and prove a clean diff before apply.
Fail closedAmbiguity becomes review—not a guessed edit.
Mixed-language proofSwift and Objective-C consumers verified together.
Signed & notarizedDeveloper ID distribution for macOS.
New in v0.4.0
External Git sources are now explainable—without becoming automatic.
PkgLift now records bounded, credential-redacted provenance for supported literal :git declarations and checks it against CocoaPods lockfile evidence.
Safety boundary: external Git sources remain
REVIEW, BLOCKED, or UNKNOWN. They never authorize AUTO migration.Typed provenance
Literal Git declarations are reconciled with lockfile source and checkout evidence.
Deterministic reasons
Mutable, unpinned, incomplete, conflicting, and unsupported evidence stays visible.
Sensitive URL data removed
User information, credentials, queries, and fragments are stripped before JSON is created.
Fail-closed preflight
Changed or lossy external evidence stops mutation before project files are written.
Workflow
Four deliberate steps
PkgLift separates discovery, decision-making, mutation, and verification so every risky transition remains visible.
2
Plan
Classify every direct dependency and save a reviewable, typed migration plan.
3
Migrate
Dry-run by default. Apply only the reviewed entries classified as AUTO.
4
Verify
Check package-product-target linkage, resolve SwiftPM, and optionally run an Xcode build.
Real-project evidence
The refusals are part of the proof.
Ten public projects are pinned and exercised through analysis, planning, and dry run without upstream mutation. Only a separate repo-owned fixture is allowed to reach apply and build verification.
Explore all pilot outcomes3 AUTO
Positive mixed case
Known dependencies move only when project context preserves the full evidence chain.
REVIEW
Hooks stay visible
Dynamic Ruby and install hooks stop otherwise plausible mappings.
BLOCKED
Local pod
A nested local dependency is detected and deliberately preserved.
UNKNOWN
No invented mapping
An exact literal declaration still stays put when registry evidence is absent.
Safety model
Not every dependency should move automatically
Evidence is complete
Exact mapping, supported locked version, verified product and target, plus complete consumer-language evidence.
Human context matters
A plausible path exists, but unsupported project context or judgment is required.
Known unsafe shape
The project contains a construct that prevents a safe automatic migration.
No exact evidence
PkgLift does not invent a repository URL, product, target, or compatible version.
A refusal is a successful safety outcome. Dynamic Ruby, install hooks, external pod sources, incomplete source profiles, ambiguous targets, and Carthage or cross-platform integration remain visible instead of being forced into an automatic conversion.
Verified case study
Swift and Objective-C consumed the same migrated package.
In the repo-owned mixed-language fixture, PkgLift migrated exactly SDWebImage, resolved SwiftPM, built for the simulator, and preserved every source and resource hash.
CocoaPods baseline
The mixed Swift and Objective-C target built before migration.
Reviewed plan
The complete AUTO set was exactly SDWebImage.
Controlled apply
Only the disposable repo-owned fixture was mutated.
Verification
SwiftPM resolution, simulator build, and protected hashes passed.
Guides
Go deeper without digging through source
Migration guide →
A practical, review-first path from installation to verified build.
Compatibility →
Source-language evidence and explicit project-integration boundaries.
Troubleshooting →
Resolve dirty worktrees, ambiguous projects, missing schemes, and conservative refusals.
Dependency Registry →
Understand exact mappings and contribute upstream-backed evidence.
Ready to inspect your project?
Start with analysis. Change nothing yet.
Install PkgLift, run analyze, and review what can move safely before generating a plan.