Why This Is Happening CodeQL’s traditional autobuild and manual build modes rely on traced extraction. During compilation, a native tracer injects into compiler process calls to capture source files and AST representations. Starting with macOS 27 and Xcode 27, Apple stripped legacy universal x86_64 architecture code from several core system binaries and developer libraries. Because parts of CodeQL's macOS tracing wrapper depended on hooks into those Intel/universal binaries, CodeQL can no longer attach to compiler invocations when Xcode 27 is installed. Key Failure Points & The "Silent Zero" RiskFloating runs-on: macos-latest: If your GitHub Actions workflow uses a floating tag, an image update to Xcode 27 or macOS 27 will break traced compilation for C/C++, C#, Go, Java, Kotlin, and Swift without warning. Silent False Negatives on Swift 6.4: Teams running Swift 6.4 have noted runs returning exit code 0 with zero detected alerts, while the SARIF logs contain extraction errors. CodeQL may exit cleanly even though 0% of the Swift codebase was actually scanned. Intel Mac Runners Deprecation: Self-hosted Intel (x86_64) Mac runners will reach end-of-support in mid-December 2026. Practical Fixes for GitHub Actions1. Pin Your Runner Image and Xcode Version (For Swift, Go, Kotlin)Because Swift, Go, and Kotlin do not have a build-mode: none option in CodeQL, the only current path is to explicitly lock your runner and Xcode version:YAMLjobs:
analyze:
# Pin to macOS 26 instead of macos-latest
runs-on: macos-26

steps:
  - name: Checkout repository
    uses: actions/checkout@v4

  # Explicitly select an Xcode 26.x toolchain
  - name: Select Xcode 26
    run: sudo xcode-select -s /Applications/Xcode_26.app/Contents/Developer

  - name: Initialize CodeQL
    uses: github/codeql-action/init@v3
    with:
      languages: swift

  - name: Perform CodeQL Analysis
    uses: github/codeql-action/analyze@v3

2. Switch to build-mode: none (For C/C++, C#, and Java)If you are running CI on macOS for C/C++, C#, or Java, bypass traced extraction entirely by using build-mode: none. In this mode, CodeQL reads and extracts files directly without intercepting the build compiler: YAML- name: Initialize CodeQL
   uses: github/codeql-action/init@v3
   with:
   languages: c-cpp # or csharp, java-kotlin
   build-mode: none
3. Decouple Production Builds from Security ScansIf an app requires Xcode 27 SDK features (e.g., App Store submissions requiring new toolchains): Job A (Release Build): Run on macos-latest / Xcode 27 to compile, package, and sign release binaries. Job B (CodeQL Scan): Run as a separate matrix job pinned to macos-26 / Xcode 26 solely for vulnerability scanning (provided your source code does not yet use language features exclusive to Swift 6.4).

If you use CodeQL on macOS, pin your workflows to macOS 26/Xcode 26 for now. Swift 6.4 is unsupported, and C/C++/C#/Java users can consider build-mode: none as a workaround.

• CodeQL traced extraction is affected by macOS 27 and Xcode 27.

• Swift 6.4 is not supported by CodeQL.

• Users should pin to macOS 26/Xcode 26 or earlier.

• For C/C++, C#, and Java, build-mode: none is a supported workaround.

_

Treat with caution

The following claims are not mentioned in the announcement itself:

1. "Silent zero" scans returning no alerts while exiting successfully.
2. Detailed explanation about CodeQL's internal tracing hooks depending on Intel binaries.
3. Specific extraction-error behaviour in SARIF logs.
4. The exact technical reason behind the tracing failure.

These may be informed assumptions or observations from users, but they are not officially confirmed in the GitHub post.