GitHub’s October 19 changelog warns of CodeQL scanning limits for Apple’s latest development tools. Check security analysis separately before adopting a newer build environment.
What breaks, and why
CodeQL’s traced extraction observes a build to collect the information it needs for analysis. GitHub says Apple has removed Intel code from some system binaries and libraries on which that tracing depends.
With Xcode 27 installed, traced extraction is unavailable for C/C++, C#, Go, Java, Kotlin and Swift. On macOS 27, GitHub says it may be unavailable.
GitHub also says Swift 6.4 is unsupported on every platform. Its supported-language table currently lists Swift 5.4 through 6.3. Swift 6.4.1 is therefore outside that documented range, although the announcement does not name the patch release separately.
Keep a compatible scanning job
GitHub recommends macOS 26 or earlier and Xcode 26 or earlier for Swift scans and other traced builds. Pin the Actions runner image and toolchain accordingly. Selecting an older Xcode on a host that also has Xcode 27 installed is not an established workaround in GitHub’s guidance.
This is a separate concern from Xcode 27 runner availability. Teams can assess a compatible security-scanning job independently from their newer build-and-test jobs, provided their source still builds with the older toolchain. Projects requiring Swift 6.4 features should not assume that downgrading the scanning job will work unchanged.
Swift has no no-build shortcut
CodeQL supports build mode none for C/C++, C# and Java. Its Swift build-mode documentation specifies macOS and either autobuild or manual. For eligible languages, no-build analysis has coverage trade-offs: build-generated code is omitted, and inaccurate dependency guesses can reduce analysis accuracy.
Before upgrading, check the CodeQL job’s actual runner, installed and selected Xcode versions, and compiler version, then verify that extraction and analysis complete. A successful application build alone is not that check.
Cover: original code-drawn artwork by MacDigest.
