Package update service

[finestructure]

Here's an idea that's not terribly unique but it could make a nice extension of SPI: an opt-in mechanism which does a package update refresh on repositories on a given cycle.

For instance, in SPI-server itself we use https://github.com/SwiftPackageIndex/SwiftPackageIndex-Server/blob/new-routing/.github/workflows/package-update.yml to update our dependencies every Monday.

We could add support for a new key in .spi.yml where authors opt-in and configure a frequency and we do the package update and open a PR against their repo automatically, without requiring any further setup.

[heckj]

I gotta admit, I was eyeing that structure the other day when I noticed a PR against the server that had various dependency updates and realized it had come from a system rather than an individual. It's a nice option to have to be able to "opt into", but it seems to be most compelling for server-side swift (and keeping track of that world) over anything more iOS or macOS specific. From my quick read of that code, it looks like it you stuff wouldn't compile on Linux, then it wouldn't be easy for the underlying GHA plugin to do it's work to update your iOS specific library - but I didn't look all that deeply into it.

[finestructure]

I think a swift package update would work even on Linux with non-Linux package updates - it's SPM that needs to work. But even if that were a problem, running the package update on macOS would be an option. (We wouldn't run is as a GHA, so it wouldn't depend on GH's, um, delayed macOS adoption 😬)

You're right that it's probably server-side projects that are currently more interested in this but I imagine this could change if there was a simple way to set it up.

The security aspect of package updates is going to be become more and more important I believe. In a previous project, risk analysis specifically considered update mechanisms/frequencies and while they focused mainly on the server component with customer data, the clients as access points are certainly going to come more into focus sooner or later.