SwiftPM依赖与Package.resolved治理（来源-版本-校验）最佳实践

实现示例type SwiftDep = { name: string; url: string; version: string } const allowHosts = new Set<string>(['github.com','git.example.com']) function validUrl(u: string): boolean { try { const x = new URL(u); return x.protocol === 'https:' && allowHosts.has(x.host) } catch { return false } } function semverLike(v: string): boolean { return /^(\d+\.\d+\.\d+)(?:[-A-Za-z0-9_.]+)?$/.test(v) } function evaluate(list: SwiftDep[]): { ok: boolean; errors: string[] } { const errors: string[] = [] for (const d of list) { if (!d.name || !validUrl(d.url) || !semverLike(d.version)) errors.push(d.name) } return { ok: errors.length === 0, errors } } 审计与CI门禁审计来源域与版本；不合规阻断并输出修复建议。变更需审批并归档。