ci: pin Xcode 26.6 for macOS 27 runners

[lawrencecchen]

Summary

The AWS M4 Pro fleet hosts move from macOS 15 to macOS 27 in place, so Xcode 27 can run there. scripts/select-ci-xcode.sh fails a job on a runner whose macOS major has no line in scripts/ci/xcode-pins.txt, and tests/test_ci_macos_xcode_selection.py requires every pin to keep the .xcode-version major (26). This adds 27 26.6: macOS 27 runners build with Xcode 26.6, which is installed next to Xcode 27.

Testing

python3 tests/test_ci_macos_xcode_selection.py passes locally. No runner is on macOS 27 yet.

Changelog

none

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Pins Xcode 26.6 for macOS 27 runners so CI jobs don't fail when the AWS M4 Pro fleet upgrades to macOS 27 in place.

• Adds the 27 26.6 line to scripts/ci/xcode-pins.txt.

^{Written for commit 1bbfcf4. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Automated builds on macOS 27 now use Xcode 26.6. The build configuration continues to require the selected Xcode version to match the project’s specified major version.
  • No changes to app features or behavior are included in this update.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7662f6bc-c2c7-4d2a-9cb8-26401a99694a

📥 Commits

Reviewing files that changed from the base of the PR and between 5a919af and 1bbfcf4.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6754f28b-2025-4517-919f-d376a77a6724

📥 Commits

Reviewing files that changed from the base of the PR and between 30226ce and 5a919af.

📒 Files selected for processing (1)

• scripts/ci/xcode-pins.txt

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The Xcode pin table now maps macOS 27 runners to Xcode 26.6. Its comments describe the runner pool and retain the requirement that each pin matches the major version in .xcode-version.

Changes

Xcode pin table

Layer / File(s)	Summary
macOS 27 runner pin scripts/ci/xcode-pins.txt	The comments describe the macOS 27 runner pool and its Xcode 26.6 pin. The table adds the 27 → 26.6 mapping.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Bug fix

Suggested reviewers: teamleaderleo

Merge Risk: ⚪ Minimal · up to 5a919

This change adds a configuration row so macOS 27 runners use Xcode 26.6, which is installed on those workers alongside Xcode 27. No concrete defect remains, and the change is low risk to merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 5a919

The new mapping preserves existing toolchain validation and does not show expanded permissions or credential access. Deployment readiness remains unverified: no macOS 27 runner is reported available yet, and its installed toolchain and host-state isolation have not been demonstrated.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The newly enabled execution path affects jobs using pool selection on macOS 27 and can reach the existing host-global xcode-select update, including its noninteractive sudo attempt. The changed mapping supplies a fixed version, not a new executable path or credential policy.

Trust Boundaries and Controls

• observed — The selector retains existing caller-controlled overrides and repository-owner-based fallback. The inspected compile-admission routing sends unrecognized external fork pull requests to a hosted fallback before consulting owned-runner placement. The pin-table addition does not modify that routing expression.

Resilience and Maintainability Implications

• observed — Existing selection side effects precede final diagnostics and have no restoration path. Repetition reasserts the selected toolchain, but concurrent host-global updates require external isolation. The selector provides a shared-machine skip control, and runner documentation describes host locking; neither establishes the upgraded AWS fleet's effective isolation or recovery behavior.

🚥 Pre-merge checks | ✅ 25

✅ Passed checks (25 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning Xcode 26.6 for macOS 27 CI runners.
Description check	✅ Passed	The description explains the problem, the resulting CI behavior, the implementation, and the testing performed. It includes Summary, Testing, and Changelog sections. The omitted demo video is not appl…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Cmux Cloud Persistent Session And Early Input	✅ Passed	PASS. The pull request changes only scripts/ci/xcode-pins.txt: it adds the 27 26.6 macOS/Xcode mapping and updates comments. It does not change Cloud terminal creation, cmux-tui transport, manual …
Cmux Swift Actor Isolation	✅ Passed	PASS. The reviewed diff changes only scripts/ci/xcode-pins.txt, adding the macOS 27 to Xcode 26.6 CI pin and comments. It introduces no production Swift code, actors, MainActor annotations, or `Se…
Cmux Swift Blocking Runtime	✅ Passed	The pull request changes only scripts/ci/xcode-pins.txt. It adds the macOS 27 to Xcode 26.6 mapping and updates comments. It introduces no Swift production code and no blocking or timing-based synch…
Cmux Browser Automation Off-Main	✅ Passed	PASS: The pull request changes only scripts/ci/xcode-pins.txt. It adds the macOS 27 to Xcode 26.6 pin and comments. It does not change browser socket commands, Sources/TerminalController.swift, `C…
Cmux Expensive Synchronous Load	✅ Passed	PASS: The pull request changes only scripts/ci/xcode-pins.txt. It adds a macOS 27 to Xcode 26.6 mapping and changes no Swift code or agent-history loading path, so this check is not applicable.
Cmux Cache Substitution Correctness	✅ Passed	PASS: The pull request changes only scripts/ci/xcode-pins.txt. It introduces no production Swift, TypeScript, or JavaScript change and no persistence, history, undo, or snapshot cache substitution.
Cmux No Hacky Sleeps	✅ Passed	The pull request changes only scripts/ci/xcode-pins.txt. It adds the macOS 27 to Xcode 26.6 mapping and comments. It introduces no sleep, timer, polling, delay, retry, or wall-clock wait in covered …
Cmux Algorithmic Complexity	✅ Passed	PASS. The PR changes only the static scripts/ci/xcode-pins.txt table and comments. It adds the 27 26.6 entry. It does not add or change production code, collection scans, sorting, filtering, joins…
Cmux Swift Concurrency	✅ Passed	The pull request changes only scripts/ci/xcode-pins.txt. The diff contains no Swift files, Swift package files, or Swift code. Therefore, it does not introduce or expand any legacy Swift concurrency…
Cmux Swift @Concurrent	✅ Passed	The authoritative pull-request diff changes only scripts/ci/xcode-pins.txt. It contains no Swift or Swift-related source changes, so the @concurrent annotation criteria do not apply.
Cmux Swift Package Boundaries	✅ Passed	The pull request changes only scripts/ci/xcode-pins.txt. It introduces no production Swift changes, so the Swift package boundary check does not apply.
Cmux Swiftpm Lockfiles	✅ Passed	PASS. The review-scoped diff changes only scripts/ci/xcode-pins.txt. It does not change a SwiftPM package, Package.swift, .gitignore, an Xcode project package reference, or any dependency pin. T…
Cmux Swift Logging	✅ Passed	The pull request changes only scripts/ci/xcode-pins.txt. It adds the macOS 27 to Xcode 26.6 pin and comments. It adds no Swift code or logging statements, so the Swift logging failure conditions do no…
Cmux User-Facing Error Privacy	✅ Passed	PASS: The PR changes only the internal CI pin table and its developer-facing comments. The diff adds macOS 27 → Xcode 26.6; the table is consumed by scripts/select-ci-xcode.sh and CI workflows. No c…
Cmux Full Internationalization	✅ Passed	PASS: The PR changes only the CI configuration table scripts/ci/xcode-pins.txt and its operational comments. The new 27 26.6 entry is consumed by scripts/select-ci-xcode.sh for runner toolchain …
Cmux Swiftui State Layout	✅ Passed	PASS: The pull request changes only scripts/ci/xcode-pins.txt, adding the macOS 27 to Xcode 26.6 pin and comments. It contains no SwiftUI, ObservableObject, @Published, @Observable, `GeometryR…
Cmux Architecture Rethink	✅ Passed	PASS: The pull request changes only scripts/ci/xcode-pins.txt. It adds the macOS 27 to Xcode 26.6 mapping and updates comments. It introduces no Swift code or architectural pattern covered by the ru…
Cmux Swift Auxiliary Window Close Shortcuts	✅ Passed	PASS: The pull request changes only scripts/ci/xcode-pins.txt. The authoritative diff contains no Swift or window-related changes, so the auxiliary-window close-shortcut rule does not apply.
Cmux Source Artifacts	✅ Passed	The PR changes only scripts/ci/xcode-pins.txt. The diff adds a macOS 27 to Xcode 26.6 CI pin and explanatory comments. This is an intentional CI configuration change, not local tool output, generate…
Cmux No Test Or Debug Seam In Production Source	✅ Passed	PASS: The review-scoped diff changes only scripts/ci/xcode-pins.txt. It contains no Swift file under a production Sources/ path, so this check does not apply.

✨ Finishing Touches 💡 1

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

1 issue found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="scripts/ci/xcode-pins.txt">

<violation number="1" location="scripts/ci/xcode-pins.txt:18">
P3: docs/ci-runners.md:85 still enumerates the pin mapping as "Xcode 26.3 on macOS 15 and Xcode 26.6 on macOS 26 today", and the new `27 26.6` pin is now the third pool in scripts/ci/xcode-pins.txt. The doc stays accurate only until the first runner reports macOS 27; update the enumeration (or add the macOS 27 pool note) in this PR so the documented pin contract matches the file.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: docs/ci-runners.md:85 still enumerates the pin mapping as "Xcode 26.3 on macOS 15 and Xcode 26.6 on macOS 26 today", and the new 27 26.6 pin is now the third pool in scripts/ci/xcode-pins.txt. The doc stays accurate only until the first runner reports macOS 27; update the enumeration (or add the macOS 27 pool note) in this PR so the documented pin contract matches the file.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At scripts/ci/xcode-pins.txt, line 18:

<comment>docs/ci-runners.md:85 still enumerates the pin mapping as "Xcode 26.3 on macOS 15 and Xcode 26.6 on macOS 26 today", and the new `27 26.6` pin is now the third pool in scripts/ci/xcode-pins.txt. The doc stays accurate only until the first runner reports macOS 27; update the enumeration (or add the macOS 27 pool note) in this PR so the documented pin contract matches the file.</comment>

<file context>
@@ -7,8 +7,12 @@
 # macOS  Xcode
 15       26.3
 26       26.6
+27       26.6
</file context>

[github-actions]

CI failure attribution

CI passes on 1bbfcf498a (run 36954013181 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's.

[github-actions]

Merge receipt for 1bbfcf498a: every check was green at merge (18 verified; 18 skipped by policy). Full suite runs on main after merge.