fix(swiftpm): Use identity as name for Swift PM registry deps

Currently only the `location` field is used to derive the `name` of a Swift
PM dependency. For dependencies fetched over a Package Registry Service
(Swift PM registry) the `location` field is empty which leads to incomplete
and invalid results. For those dependencies the `identity` needs to be used
instead.

Signed-off-by: Marco Lied <[email protected]>

Author: liedQM

plugins/package-managers/swiftpm/src/funTest/assets/projects/synthetic/expected-output-only-lockfile-v3-with-SPM-registry-dependency.yml

@@ -0,0 +1,48 @@
+---
+project:
+  id: "SwiftPM::src/funTest/assets/projects/synthetic/only-lockfile-v3-with-SPM-registry-dependency/Package.resolved:<REPLACE_REVISION>"
+  definition_file_path: "<REPLACE_DEFINITION_FILE_PATH>"
+  declared_licenses: []
+  declared_licenses_processed: {}
+  vcs:
+    type: ""
+    url: ""
+    revision: ""
+    path: ""
+  vcs_processed:
+    type: "Git"
+    url: "<REPLACE_URL_PROCESSED>"
+    revision: "<REPLACE_REVISION>"
+    path: "<REPLACE_PATH>"
+  homepage_url: ""
+  scopes:
+  - name: "dependencies"
+    dependencies:
+    - id: "Swift::alamofire.alamofire:5.4.4"
+packages:
+- id: "Swift::alamofire.alamofire:5.4.4"
+  purl: "pkg:swift/[email protected]"
+  declared_licenses: []
+  declared_licenses_processed: {}
+  description: ""
+  homepage_url: ""
+  binary_artifact:
+    url: ""
+    hash:
+      value: ""
+      algorithm: ""
+  source_artifact:
+    url: ""
+    hash:
+      value: ""
+      algorithm: ""
+  vcs:
+    type: ""
+    url: ""
+    revision: ""
+    path: ""
+  vcs_processed:
+    type: ""
+    url: ""
+    revision: ""
+    path: ""

plugins/package-managers/swiftpm/src/funTest/assets/projects/synthetic/only-lockfile-v3-with-SPM-registry-dependency/Package.resolved

@@ -0,0 +1,13 @@
+{
+  "pins" : [
+    {
+      "identity" : "alamofire.alamofire",
+      "kind" : "registry",
+      "location" : "",
+      "state" : {
+        "version" : "5.4.4"
+      }
+    }
+  ],
+  "version" : 3
+}

plugins/package-managers/swiftpm/src/funTest/kotlin/SwiftPmFunTest.kt

@@ -73,6 +73,19 @@ class SwiftPmFunTest : WordSpec({
         }
     }
 
+    "Analyzing a lockfile with a dependency loaded over SPM registry instead of source control" should {
+        "return the correct result" {
+            val definitionFile =
+                getAssetFile("projects/synthetic/only-lockfile-v3-with-SPM-registry-dependency/Package.resolved")
+            val expectedResultFile =
+                getAssetFile("projects/synthetic/expected-output-only-lockfile-v3-with-SPM-registry-dependency.yml")
+
+            val result = SwiftPmFactory.create().resolveSingleProject(definitionFile)
+
+            result.withInvariantIssues().toYaml() should matchExpectedResult(expectedResultFile, definitionFile)
+        }
+    }
+
     "Analyzing a definition file with a sibling lockfile" should {
         "return the correct result" {
             val definitionFile = getAssetFile("projects/synthetic/project-with-lockfile/Package.swift")

plugins/package-managers/swiftpm/src/main/kotlin/SwiftPm.kt

@@ -244,7 +244,12 @@ private fun PinV2.toId(): Identifier =
     Identifier(
         type = PACKAGE_TYPE,
         namespace = "",
-        name = getCanonicalName(location),
+        // For SPM registry dependencies the `location` field is blank, so use the `identity` field instead.
+        name = if (kind == PinV2.Kind.REGISTRY) {
+            identity
+        } else {
+            getCanonicalName(location)
+        },
         version = state?.run {
             when {
                 !version.isNullOrBlank() -> version