DEV Community

Cover image for CodeQL can't trace Xcode 27 builds or scan Swift 6.4
techaiwire
techaiwire

Posted on Originally published at techaiwire.com

CodeQL can't trace Xcode 27 builds or scan Swift 6.4

#security #apple #ios #codeql

GitHub said on October 19, 2026 that CodeQL, its code-scanning engine, cannot trace builds made with Xcode 27 and cannot analyze Swift 6.4 code on any platform. For iOS and Mac teams that run security scans in their build pipeline, moving to Apple's newest tools now means losing part of those scans until GitHub ships support.

What GitHub announced

CodeQL is the tool behind GitHub's code scanning. It turns a project's source code into a database, then runs queries against it to find security bugs. For compiled languages, it usually builds that database by "tracing" the build: it watches the compiler as it runs and records each file as it is compiled.

That tracing is what breaks. Starting with macOS 27 and Xcode 27, Apple no longer includes Intel (x86_64) code in some system files that CodeQL relies on, according to GitHub's changelog. Those files are binaries and libraries that CodeQL uses to trace builds. The notice states it plainly: "CodeQL can't support traced scans on these versions or analyze Swift 6.4."

Setup What GitHub says
Xcode 27 installed Traced extraction is not available for C/C++, C#, Go, Java, Kotlin or Swift
macOS 27 Traced extraction may not be available for the same six languages
Swift 6.4 Not supported on any platform
Intel-based Macs CodeQL support deprecated in mid-December 2026

The changelog gives no date for Swift 6.4 support.

Why upgrading Xcode pulls in Swift 6.4

The Swift problem is hard to avoid for a team that updates its tools. Apple's Xcode requirements page lists three current releases: Xcode 27, Xcode 27.1 and the Xcode 27.2 beta 3. All three ship the Swift 6.4 compiler. All three need a Mac running macOS Tahoe 26.6 or later.

So there is no Xcode 27 build that keeps an older Swift compiler. Moving to Xcode 27 means moving to Swift 6.4, the release that brought async defer and made Swift Build the default. It also means losing CodeQL's Swift analysis. That matters for apps that need Xcode 27 itself. The Xcode 27.1 release candidate, for example, is what opened App Store submissions for iPhone Duo apps.

The workarounds GitHub suggests

GitHub's notice lists three ways to keep scans running:

  • Pin to the previous tools. Workflows that scan Swift, or that rely on traced builds, should run on macOS 26 or earlier with Xcode 26 or earlier.
  • Pin the runner and toolchain. In GitHub Actions, set the runner image and toolchain version explicitly, so an image update cannot move a scan onto Xcode 27 without warning.
  • Skip tracing where possible. For C/C++, C# and Java, use CodeQL's build mode "none." In that mode, CodeQL reads the source files directly instead of watching a build, so the missing Intel code does not matter.

The notice offers build mode "none" only for those three languages. For Swift, its only advice is to stay on Xcode 26 or earlier.

What this means for developers

The risk here is a scan that keeps running but quietly stops covering your code. A few checks are worth doing this week:

  • Find out what your scan job really runs on. If a CodeQL workflow uses a floating runner label rather than a pinned image, check which macOS and Xcode versions it gets today. Then pin them, as GitHub recommends.
  • Read the scan logs, not only the result. A green check mark means the job finished. It does not prove Swift files were analyzed. Look at the extraction step in the log and confirm your Swift sources appear in it.
  • Split the build from the scan. Teams that must ship with Xcode 27 can keep building releases on it. They can run the CodeQL job separately on a pinned macOS 26 and Xcode 26 runner. That works only while the code still builds with Xcode 26, so adopting Swift 6.4-only features ends it.
  • Plan for Intel runners now. Self-hosted Intel Mac runners lose CodeQL support in mid-December 2026. Budget for Apple silicon machines before then.
  • Watch the next CodeQL release notes. The 2.27.1 release added a C++ query and read Actions lock files. Swift 6.4 support would arrive the same way, and that is the point to unpin.

This article was first published on Tech AI Wire.

Also available in

Deutsch · 日本語 · Français · Español · Português

Related on Tech AI Wire

Sources

Top comments (0)