GitHub published CodeQL compatibility guidance on October 19, 2026, for teams moving to macOS 27, Xcode 27 or Swift 6.4. The update says Apple no longer includes Intel x86_64 code in some system binaries and libraries that CodeQL uses to trace builds. As a result, traced extraction is unavailable for several compiled languages on Xcode 27, may be unavailable on macOS 27, and Swift 6.4 is not supported by CodeQL on any platform.
What is affected
GitHub lists three related limits. First, with Xcode 27 installed, traced extraction is not available for C/C++, C#, Go, Java, Kotlin or Swift. Second, traced extraction may not be available for those languages on macOS 27. Third, CodeQL does not support Swift 6.4 on any platform. GitHub also says support for Intel-based Macs will be deprecated in mid-December 2026.
These are compatibility constraints for CodeQL extraction and analysis, not a statement that all code scanning stops on every Apple platform. The impact depends on the runner image, installed Xcode version, language and build mode used by the workflow.
Why tracing depends on the toolchain
For compiled languages, CodeQL may need to observe the build so it can collect the compiler commands and other information needed to create a database for analysis. That process depends on details of the operating system, compiler and libraries available during the build.
GitHub's notice ties the change to missing Intel x86_64 code in some macOS 27 and Xcode 27 system binaries and libraries. The important operational lesson is to treat runner images and compiler versions as part of the analysis configuration, rather than assuming that a workflow will behave the same when the latest image is selected automatically.
How to keep scans running
GitHub recommends pinning workflows to macOS 26 or earlier and Xcode 26 or earlier when scanning Swift or using traced builds for the affected languages. In GitHub Actions, specify a known runner image and toolchain instead of relying on a floating latest version. This makes the scan environment more reproducible and gives teams time to test compatibility changes deliberately.
For C/C++, C# and Java, GitHub also says teams can switch to CodeQL's build mode none, which does not require tracing a build. Confirm the language-specific limitations and requirements in the current CodeQL documentation before changing a workflow. Do not assume that this option is an equivalent replacement for every language or analysis setup.
A practical workflow review
- List each CodeQL workflow and identify the language, runner image, Xcode version and build mode it uses.
- Check whether the workflow explicitly pins macOS and Xcode or inherits a moving default.
- For Swift or other traced builds, temporarily use the supported macOS 26 and Xcode 26 toolchain recommended by GitHub.
- For eligible C/C++ or C# and Java workflows, assess whether build mode none meets the repository's analysis needs.
- Run the workflow on a test branch and confirm that database creation, analysis and SARIF upload all complete.
- Keep a copy of the previous working workflow so the change can be rolled back quickly.
- Schedule a follow-up to revisit the pinned versions when GitHub publishes updated compatibility guidance.
What teams should avoid
Do not change the runner image, Xcode version and CodeQL configuration all at once without recording the result. If a scan stops working, multiple simultaneous changes make it harder to isolate the cause. Also avoid treating a successful workflow run as proof that the analysis is equivalent; compare the language coverage and extraction mode before and after the change.
For related background, see our CodeQL 2.27.2 update guide. That article covers a separate CodeQL release update; this one focuses on the macOS, Xcode and Swift compatibility limits announced on October 19.
What to watch next
The immediate priority is to keep scans reproducible and preserve the intended analysis coverage. Teams should monitor the official CodeQL changelog and documentation for support updates, then test a toolchain upgrade in a controlled workflow before changing the default runner used by critical repositories.
Sources
- GitHub Changelog: CodeQL changes for macOS 27, Xcode 27, and Swift 6.4
- GitHub Docs: CodeQL code scanning for compiled languages