[CI] Select latest stable Xcode on macOS

taalexander · taalexander · commit d08c600e9a3b · 2026-05-04T13:36:33.000-03:00
Use a local composite action to pick the newest non-beta Xcode and log the selected toolchain so macOS CI follows runner image updates. Include the selected Xcode in the dev environment cache key and let set_env_defaults.sh choose LLVM projects.

Signed-off-by: Thomas Alexander &lt;talexander@nvidia.com&gt;
diff --git a/.github/actions/setup-xcode-stable/action.yml b/.github/actions/setup-xcode-stable/action.yml
@@ -0,0 +1,94 @@
+name: Set up latest stable Xcode
+description: Select the newest non-beta Xcode installed on the macOS runner.
+
+outputs:
+  version:
+    description: Selected Xcode version.
+    value: ${{ steps.select.outputs.version }}
+  build:
+    description: Selected Xcode build number.
+    value: ${{ steps.select.outputs.build }}
+  path:
+    description: Selected Xcode application path.
+    value: ${{ steps.select.outputs.path }}
+  developer-dir:
+    description: Selected Xcode developer directory.
+    value: ${{ steps.select.outputs.developer-dir }}
+
+runs:
+  using: composite
+  steps:
+    - id: select
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        # Mirrors the selection strategy from maxim-lobanov/setup-xcode
+        # (scan installed Xcode apps, ignore beta releases, choose newest
+        # stable), but keeps it local to avoid external-action allowlist issues.
+        selection_file=$(mktemp)
+        python3 > "$selection_file" <<'PY'
+        from pathlib import Path
+        import plistlib
+        import re
+        import sys
+
+        def semver_key(version):
+            return tuple(int(part) for part in re.findall(r"\d+", version))
+
+        versions = []
+        for app in Path("/Applications").iterdir():
+            if not app.is_dir() or app.is_symlink():
+                continue
+            if not re.match(r"^Xcode.*\.app$", app.name):
+                continue
+
+            version_plist = app / "Contents" / "version.plist"
+            license_plist = app / "Contents" / "Resources" / "LicenseInfo.plist"
+            if not version_plist.exists() or not license_plist.exists():
+                continue
+
+            with version_plist.open("rb") as handle:
+                version_info = plistlib.load(handle)
+            with license_plist.open("rb") as handle:
+                license_info = plistlib.load(handle)
+
+            version = str(version_info.get("CFBundleShortVersionString", ""))
+            build = str(version_info.get("ProductBuildVersion", ""))
+            license_type = str(license_info.get("licenseType", "")).lower()
+            if not version or not license_type or "beta" in license_type:
+                continue
+
+            versions.append((semver_key(version), version, build, str(app)))
+
+        if not versions:
+            print("No stable Xcode installation found in /Applications.", file=sys.stderr)
+            sys.exit(1)
+
+        _, version, build, path = sorted(versions, reverse=True)[0]
+        print(path)
+        print(version)
+        print(build)
+        PY
+
+        xcode_path=$(sed -n '1p' "$selection_file")
+        xcode_version=$(sed -n '2p' "$selection_file")
+        xcode_build=$(sed -n '3p' "$selection_file")
+        rm -f "$selection_file"
+
+        developer_dir="$xcode_path/Contents/Developer"
+        if [ ! -d "$developer_dir" ]; then
+          echo "Could not find Xcode developer directory: $developer_dir"
+          exit 1
+        fi
+
+        sudo xcode-select -s "$developer_dir"
+        echo "DEVELOPER_DIR=$developer_dir" >> "$GITHUB_ENV"
+        echo "MD_APPLE_SDK_ROOT=$xcode_path" >> "$GITHUB_ENV"
+
+        echo "path=$xcode_path" >> "$GITHUB_OUTPUT"
+        echo "version=$xcode_version" >> "$GITHUB_OUTPUT"
+        echo "build=$xcode_build" >> "$GITHUB_OUTPUT"
+        echo "developer-dir=$developer_dir" >> "$GITHUB_OUTPUT"
+
+        echo "Selected Xcode $xcode_version ($xcode_build) at $xcode_path"
diff --git a/.github/workflows/ci_macos.yml b/.github/workflows/ci_macos.yml
@@ -128,6 +128,17 @@ jobs:
         with:
           python-version: '3.12'
 
+      - name: Select latest stable Xcode
+        uses: ./.github/actions/setup-xcode-stable
+
+      - name: Log macOS toolchain
+        run: |
+          sw_vers
+          xcodebuild -version
+          xcrun --show-sdk-path
+          xcrun --show-sdk-version
+          clang --version
+
       - name: Set up ccache and ORAS
         uses: ./.github/actions/ccache-setup
 
@@ -158,7 +169,6 @@ jobs:
         run: |
           source scripts/set_env_defaults.sh
           Python3_EXECUTABLE="$(which python3)" \
-          LLVM_PROJECTS='clang;lld;mlir;openmp;python-bindings' \
           LLVM_SOURCE="$HOME/.llvm-project" \
           bash scripts/build_llvm.sh -c Release -v -j $(sysctl -n hw.ncpu)
 
@@ -209,6 +219,17 @@ jobs:
         with:
           python-version: ${{ matrix.python_version }}
 
+      - name: Select latest stable Xcode
+        uses: ./.github/actions/setup-xcode-stable
+
+      - name: Log macOS toolchain
+        run: |
+          sw_vers
+          xcodebuild -version
+          xcrun --show-sdk-path
+          xcrun --show-sdk-version
+          clang --version
+
       - name: Set up ccache and ORAS
         uses: ./.github/actions/ccache-setup
 
@@ -235,7 +256,6 @@ jobs:
         run: |
           source scripts/set_env_defaults.sh
           Python3_EXECUTABLE="$(which python3)" \
-          LLVM_PROJECTS='clang;lld;mlir;openmp;python-bindings' \
           LLVM_SOURCE="$HOME/.llvm-project" \
           bash scripts/build_llvm.sh -c Release -v -j $(sysctl -n hw.ncpu)
 
@@ -291,6 +311,17 @@ jobs:
         with:
           python-version: ${{ matrix.python_version }}
 
+      - name: Select latest stable Xcode
+        uses: ./.github/actions/setup-xcode-stable
+
+      - name: Log macOS toolchain
+        run: |
+          sw_vers
+          xcodebuild -version
+          xcrun --show-sdk-path
+          xcrun --show-sdk-version
+          clang --version
+
       - name: Download wheel artifact
         uses: actions/download-artifact@v4
         with:
@@ -339,6 +370,17 @@ jobs:
         with:
           python-version: '3.12'
 
+      - name: Select latest stable Xcode
+        uses: ./.github/actions/setup-xcode-stable
+
+      - name: Log macOS toolchain
+        run: |
+          sw_vers
+          xcodebuild -version
+          xcrun --show-sdk-path
+          xcrun --show-sdk-version
+          clang --version
+
       - name: Set up ccache and ORAS
         uses: ./.github/actions/ccache-setup
 
@@ -367,7 +409,6 @@ jobs:
         run: |
           source scripts/set_env_defaults.sh
           Python3_EXECUTABLE="$(which python3)" \
-          LLVM_PROJECTS='clang;lld;mlir;openmp;python-bindings' \
           LLVM_SOURCE="$HOME/.llvm-project" \
           bash scripts/build_llvm.sh -c Release -v -j $(sysctl -n hw.ncpu)
 
@@ -418,6 +459,17 @@ jobs:
         with:
           python-version: '3.12'
 
+      - name: Select latest stable Xcode
+        uses: ./.github/actions/setup-xcode-stable
+
+      - name: Log macOS toolchain
+        run: |
+          sw_vers
+          xcodebuild -version
+          xcrun --show-sdk-path
+          xcrun --show-sdk-version
+          clang --version
+
       - name: Download installer artifact
         uses: actions/download-artifact@v4
         with:
diff --git a/.github/workflows/dev_environment_macos.yml b/.github/workflows/dev_environment_macos.yml
@@ -141,17 +141,32 @@ jobs:
       - name: Log in to GitHub CR
         run: echo "${{ github.token }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin
 
+      - name: Select latest stable Xcode
+        uses: ./.github/actions/setup-xcode-stable
+
+      - name: Log macOS toolchain
+        run: |
+          sw_vers
+          xcodebuild -version
+          xcrun --show-sdk-path
+          xcrun --show-sdk-version
+          clang --version
+
       - name: Compute cache key
         id: cache_key
         run: |
           # Combine build scripts hash with the runner image version to detect
           # tool updates (cmake, compilers, etc.) that would invalidate the cache.
+          # Include the selected Xcode as well because the same runner image can
+          # contain multiple SDK/compiler releases.
           scripts_hash=${{ needs.metadata.outputs.scripts_hash }}
           runner_image=${ImageVersion:-unknown}
-          deps_hash=$(echo "${scripts_hash}-${runner_image}" | shasum -a 256 | cut -c1-8)
+          developer_dir=${DEVELOPER_DIR:-$(xcode-select -p 2>/dev/null || echo unknown)}
+          xcode_version=$(xcodebuild -version 2>/dev/null | shasum -a 256 | cut -c1-8 || echo unknown)
+          deps_hash=$(echo "${scripts_hash}-${runner_image}-${developer_dir}-${xcode_version}" | shasum -a 256 | cut -c1-8)
           image_name="${{ needs.metadata.outputs.image_name_base }}${deps_hash}"
           echo "image_name=$image_name" >> $GITHUB_OUTPUT
-          echo "Cache key: scripts_hash=$scripts_hash runner_image=$runner_image deps_hash=$deps_hash"
+          echo "Cache key: scripts_hash=$scripts_hash runner_image=$runner_image developer_dir=$developer_dir xcode_version=$xcode_version deps_hash=$deps_hash"
           echo "Image name: $image_name"
 
       - name: Check for cached image
@@ -182,7 +197,6 @@ jobs:
           # wheel jobs only change Python3_EXECUTABLE, which keeps ninja's
           # incremental rebuild scoped to the binding targets.
           source scripts/set_env_defaults.sh
-          export LLVM_PROJECTS='clang;lld;mlir;openmp;python-bindings'
           
           echo "Building prerequisites..."
           echo "LLVM_INSTALL_PREFIX=$LLVM_INSTALL_PREFIX"
