CodeQL 2.27.2 on macOS: verify OS, Xcode, and analysis mode together
A successful CI build does not establish that security analysis succeeded in the same environment. GitHub’s October 9 CodeQL 2.27.2 announcement includes macOS tracing limits alongside language improvements. Before switching runner images, record the OS, Xcode, language, and build mode as one configuration.
Start with the documented boundary
GitHub says autobuild and manual modes for compiled languages are unsupported on macOS 27 with any Xcode version, and on macOS 26 with Xcode 27 selected. It recommends at most macOS 26 and Xcode 26 for these modes. This is a CodeQL traced-analysis boundary, not a prediction that every ordinary application build will fail. Read the analysis improvements and environment restriction together.
Separate a green build from analysis evidence
For a small team, a reproducible configuration matters more than a version label. Link the runner OS, selected Xcode, CodeQL version, language, build mode, commit, logs, and SARIF to the same run. Check that analysis actually ran for the intended language and included the intended source. Interpret zero alerts only after establishing what was analyzed.
Run a small comparison before changing runners
Keep a baseline on the existing analysis environment and test the proposed environment in a separate job. Use team-owned fixtures or an existing test repository, without secrets or real attack payloads. Compare database creation, completion, output format, and elapsed time. Do not claim improved detection or speed without measurements. If a configuration is blocked, document a supported option and an owner rather than quietly dropping the scan.
Do not treat none as a universal workaround
The announcement says work to improve none-mode support on macOS is underway. That does not establish an immediate replacement for every language or project. Check the current language support and configuration, then compare extracted code and results after any mode change. Triage new alerts against analyzer/model changes and actual code before suppressing them or declaring a vulnerability.
Today’s useful output is one environment record. Capture the current evidence, read the proposed combination’s limits, and compare a small run. This comparison and rollback procedure is an operational recommendation, not a GitHub mandate. No community sentiment or estimated benchmarks are presented as factual evidence.
Official sources and scope
Checked October 12, 2026. Recheck current release notes and repository settings before applying changes.