BuildRiot
Sign in

SecuritySource: GitHub

GitHub details CodeQL build tracing limits for macOS 27 and Xcode 27

GitHub said Xcode 27 installations prevent CodeQL build tracing, while macOS 27 may prevent it. Teams upgrading Apple CI may need older toolchains or, for certain languages, analysis without a build.

GitHub logo
Cover: BuildRiot

GitHub said on October 19, 2026, that CodeQL traced extraction is unavailable with Xcode 27 installed and may be unavailable on macOS 27. GitHub attributes the restrictions to Apple removing Intel x86_64 code from some system binaries and libraries. Sources: GitHub

The notice names C/C++, C#, Go, Java, Kotlin and Swift as affected traced languages and says Swift 6.4 is unsupported on every platform. GitHub plans to deprecate Intel Mac support in mid-December 2026, without specifying a day. Sources: GitHub

GitHub’s October 9, 2026, CodeQL 2.27.2 announcement warned that autobuild and manual modes were unsupported on macOS 27 or macOS 26 with Xcode 27 selected. The October 19 notice instead refers to Xcode 27 being installed and says macOS 27 may prevent tracing. Neither notice gives a date for restoring tracing support. Sources: GitHub

GitHub advises pinning both macOS and Xcode to version 26 or earlier for traced builds, with explicit runner-image and toolchain pins in GitHub Actions. It also offers build-mode: none for C/C++, C# and Java; its documentation says this mode excludes generated code and can reduce accuracy through incorrect dependency assumptions. For Java repositories containing Kotlin, this mode excludes Kotlin analysis and produces a warning. Sources: GitHub

Zetta360 reported a failed CotEditor scan and a successful Monolingual scan on xcode-27-arm64, but said the completeness of Monolingual’s database was unclear. GitHub’s notice does not provide a complete breakdown of affected Intel and Apple silicon configurations or specify which macOS 27 configurations may prevent tracing. Sources: GitHub, Zetta360

What to do

  1. For Swift or other traced builds, pin both the macOS runner image and Xcode toolchain to version 26 or earlier in GitHub Actions.
  2. Before switching C/C++, C# or Java to build-mode: none, assess its generated-code exclusions, dependency assumptions and, for mixed Java/Kotlin repositories, loss of Kotlin analysis. Sources: GitHub

Why it matters

Apple CI upgrades can leave teams without supported CodeQL build tracing. GitHub recommends older toolchains; analysis without a build is an alternative for certain languages, with accuracy and coverage trade-offs.

Attribution

Sources

  1. 1GitHubCodeQL changes for macOS 27, Xcode 27, and Swift 6.4Source published (UTC)
  2. 2GitHubCodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysisSource published (UTC)
  3. 3GitHubCodeQL code scanning for compiled languages
  4. 4Zetta360CodeQL Swift Scanning Has No Supported Setup on Xcode 27. Some Runs Still Pass.Source published (UTC)

Read the original source for full details and context.

Report a problem

Links, dates or what you expected. Do not include passwords or private data.

More on Security

All Security stories