ci: pin exact Xcode 26.3 on macOS jobs (definitive libz.tbd fix)

[fernandotonon]

Definitive fix for the recurring macOS libz.tbd deploy failure.

Root cause (peeled back over several attempts): the macOS jobs run on runner images whose newest Xcode differs (one job resolved 26.5, another 26.3). The OGRE/Assimp SDKs bake the active SDK's absolute libz.tbd path into their CMake export, so a producer that built under 26.5 cached an SDK the 26.3 consumer can't link (No rule to make target '.../Xcode_26.5/...libz.tbd'). sort -V | tail -1 (newest) is non-deterministic across images; SDKROOT pinning helped the app's own ZLIB but the cached Codec_Assimp/ogre dylibs still carried the producer's path.

Fix: pin a SPECIFIC Xcode (26.3, present on all current macos-latest images) on all three macOS jobs, falling back to newest only if absent — so producers and consumer always agree on the SDK. Bump MACOS_CACHE_VERSION → xc263pin to discard the assimp+ogre caches that still carry a 26.5 path. (Keeps the SDKROOT pin + self-heal OGRE rebuild from the prior fixes as belt-and-suspenders.)

Needed to complete the 3.9.1 macOS deploy (Windows + Linux already published; macOS artifact + Homebrew cask pending).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated macOS CI/CD pipeline cache versioning to force rebuild when necessary.
  • Modified Xcode SDK selection logic to use pinned installation with fallback to automatic detection for improved build consistency.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR bumps the MACOS_CACHE_VERSION env var from sdkpin1 to xc263pin to force cache invalidation, and replaces the dynamic "newest Xcode" selection logic in all three macOS build jobs (build-n-cache-assimp-macos, build-n-cache-ogre-macos, build-macos) with logic that pins to /Applications/Xcode_26.3.app/Contents/Developer when present, falling back to the previous newest-available detection otherwise.

Changes

Xcode 26.3 pin and cache invalidation

Layer / File(s)	Summary
Cache version bump .github/workflows/deploy.yml	MACOS_CACHE_VERSION changed from sdkpin1 to xc263pin to invalidate all macOS job caches.
Pinned Xcode selection across macOS build jobs .github/workflows/deploy.yml	DEV selection in build-n-cache-assimp-macos, build-n-cache-ogre-macos, and build-macos updated to prefer the fixed Xcode 26.3 developer directory, with fallback to newest-Xcode detection when absent.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• fernandotonon/QtMeshEditor#756: Modifies the same deploy.yml file to pin the macOS Xcode toolchain and bump cache version tags for the OGRE/macOS build jobs — directly the same file and same pattern as this PR.

Poem

🐰 Hoppity-hop through the CI lane,
Xcode 26.3 is the one we'll retain!
sdkpin1 is gone, xc263pin is here,
With a fallback in place so builds stay clear.
No more stale caches to muddy the trail —
The bunny ensures every macOS job shall prevail! 🍎

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description explains the root cause, solution, and impact clearly, but does not follow the required template structure with Summary, Technical Details, and other sections.	Restructure the description to match the template: add a Summary section, list Technical Details as bullet points, and include relevant checklist items if applicable.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: pinning Xcode 26.3 on macOS CI jobs to fix the libz.tbd deployment issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/macos-pin-exact-xcode

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/deploy.yml (1)

1577-1590: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Deduplicate the pinned Xcode path across the three macOS jobs.

Line 1585, Line 1664, and Line 1752 repeat the same hardcoded pin. Centralizing it in workflow env reduces drift risk when the pin changes again.

♻️ Suggested refactor

 env:
   BUILD_TYPE: Release
   AQT_VERSION: '==3.3.*'
   QT_VERSION: '6.9.3'
+  PINNED_XCODE_DEV_DIR: '/Applications/Xcode_26.3.app/Contents/Developer'
   ASSIMP_VERSION: '6.0.4'

-            PIN="/Applications/Xcode_26.3.app/Contents/Developer"
+            PIN="$PINNED_XCODE_DEV_DIR"
             if [ -d "$PIN" ]; then
                 DEV="$PIN"
             else
                 DEV=$(ls -d /Applications/Xcode_*.app/Contents/Developer 2>/dev/null | sort -V | tail -1)
             fi

Also applies to: 1662-1669, 1750-1757

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy.yml around lines 1577 - 1590, The hardcoded Xcode
pin "Xcode_26.3.app" is repeated in three separate macOS job sections at lines
1585, 1664, and 1752 in the workflow file. To reduce drift risk when this pin
needs to be updated in the future, extract this value into a single environment
variable defined at the top-level workflow `env` section, and then reference
that variable (using ${{ env.VARIABLE_NAME }}) in all three job locations where
the PIN variable is currently set.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/deploy.yml:
- Around line 1577-1590: The hardcoded Xcode pin "Xcode_26.3.app" is repeated in
three separate macOS job sections at lines 1585, 1664, and 1752 in the workflow
file. To reduce drift risk when this pin needs to be updated in the future,
extract this value into a single environment variable defined at the top-level
workflow `env` section, and then reference that variable (using ${{
env.VARIABLE_NAME }}) in all three job locations where the PIN variable is
currently set.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 46921318-a1df-49e5-9fac-a079e6f6037a

📥 Commits

Reviewing files that changed from the base of the PR and between dc03896 and 97b0a0b.

📒 Files selected for processing (1)

• .github/workflows/deploy.yml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud