CodeQL no longer supports macOS 27, Xcode 27, and Swift 6.4

What changed

Starting with macOS 27 and Xcode 27, Apple no longer includes Intel (x86_64) code in some of the system binaries and libraries that CodeQL depends on to trace builds. This fundamental change in Apple's toolchain architecture means CodeQL cannot support traced scans on these versions or analyze Swift 6.4.

The impact varies by language and platform. When Xcode 27 is installed, traced extraction becomes unavailable for C/C++, C#, Go, Java, Kotlin, and Swift. On macOS 27, traced extraction may not be available for these same languages. CodeQL offers no support for Swift 6.4 regardless of which platform you run it on. Additionally, GitHub has announced that CodeQL support for Intel-based Macs will be deprecated in mid-December 2026.

How to keep scans running

If your workflows depend on Swift or use traced builds for other languages, pin your GitHub Actions workflows to macOS 26 or earlier and Xcode 26 or earlier. Rather than relying on the latest runner images and toolchains, explicitly specify the versions in your workflow configuration.

Developers using C/C++, C#, and Java have an additional option. You can switch to build mode none, which does not require tracing a build. This approach bypasses the dependency on the Intel code in system binaries and allows analysis to proceed without changing your macOS or Xcode versions. However, this mode may have different analysis characteristics compared to traced builds, so review CodeQL documentation to understand any trade-offs for your security requirements.

Who it affects

The change affects any team using GitHub code scanning with CodeQL on the latest Apple platforms. If you develop in Swift or rely on traced builds for compiled languages like C++, Java, or Go, your current workflows will break when you upgrade to macOS 27 or Xcode 27. Teams with Intel-based Macs should also plan for the deprecation announcement in mid-December 2026, after which CodeQL support for those machines will end.

Why it matters

This change reflects Apple's broader transition away from Intel architecture toward Apple Silicon. While this shift benefits performance and energy efficiency on new Macs, it creates compatibility gaps for development tools. CodeQL's reliance on Intel binaries in system libraries means the tool cannot adapt to the new architecture without substantial changes from Apple or CodeQL itself. For security teams relying on CodeQL for code scanning in CI/CD pipelines, the loss of traced builds on the newest platforms forces a difficult choice: stay on older macOS and Xcode versions, switch to untraced builds with potentially reduced analysis depth, or migrate to alternative security scanning tools. Planning an upgrade strategy now will help avoid disruption to your security workflows.

Source

AI-assisted, verified against the source. This post was drafted with AI from the primary source linked above and checked automatically against it. For anything you depend on, read the original.