chore(build): enforce Xcode 27.0 for Apple builds

Signed-off-by: Tom Brow <tomb@block.xyz>

.github/workflows/_ci-clients.yml

@@ -121,11 +121,16 @@ jobs:
 
   mobile-swift:
     name: Mobile Swift
-    runs-on: macos-latest
+    runs-on: xcode-27
     timeout-minutes: 30
     if: inputs.lane == 'mobile-swift' && inputs.mobile
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Select pinned Xcode
+        run: |
+          export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
+          scripts/check-xcode.sh
+          echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - name: Install Flutter dependencies
         run: cd mobile && flutter pub get

.github/workflows/_ci-desktop-macos.yml

@@ -23,18 +23,24 @@ env:
 jobs:
   desktop-build-macos:
     name: Desktop Build (macOS)
-    runs-on: macos-latest
+    runs-on: xcode-27
     timeout-minutes: 45
     if: github.event_name == 'push' || inputs.desktop || inputs.desktop_rust || inputs.rust
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Select pinned Xcode
+        run: |
+          export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
+          scripts/check-xcode.sh
+          echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - name: Verify macOS icon representations
         run: scripts/macos-icon.sh --check
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
         with:
+          key: xcode-${{ hashFiles('.xcode-version') }}
           workspaces: desktop/src-tauri
           save-if: ${{ github.event_name != 'pull_request' }}
       - name: Install desktop dependencies
@@ -64,7 +70,7 @@ jobs:
         uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ github.workspace }}/.cache/mesh-llama
-          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
+          key: mesh-llama-${{ runner.os }}-metal-${{ hashFiles('.xcode-version') }}-${{ steps.mesh_rev.outputs.rev }}
       - name: Build mesh llama native libraries
         if: steps.llama_cache.outputs.cache-hit != 'true'
         env:
@@ -88,7 +94,7 @@ jobs:
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ github.workspace }}/.cache/mesh-llama
-          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
+          key: mesh-llama-${{ runner.os }}-metal-${{ hashFiles('.xcode-version') }}-${{ steps.mesh_rev.outputs.rev }}
       - name: Build Tauri app
         run: cd desktop && pnpm tauri build
         env:

.github/workflows/ci.yml

@@ -71,6 +71,8 @@ jobs:
               - '.github/workflows/_ci-desktop.yml'
               - 'scripts/ci-apt-retry.sh'
               - 'Justfile'
+              - '.xcode-version'
+              - 'scripts/check-xcode.sh'
               - 'scripts/generate-macos-icon.py'
               - 'scripts/macos-icon.sh'
               - 'bin/uv'
@@ -86,6 +88,8 @@ jobs:
               - 'pnpm-lock.yaml'
             mobile:
               - 'mobile/**'
+              - '.xcode-version'
+              - 'scripts/check-xcode.sh'
               - 'scripts/mobile-release.sh'
               - 'scripts/mobile-worktree-overrides.sh'
               - 'scripts/mobile-worktree-clean.sh'
@@ -108,7 +112,9 @@ jobs:
           scripts/test-postgres-test-discovery.sh
           scripts/test-postgres-test-wrapper.sh
       - name: Release workflow source contract
-        run: scripts/test-release-ref-contract.sh
+        run: |
+          scripts/test-release-ref-contract.sh
+          scripts/test-xcode-version.sh
       - name: Relay image eligibility contract
         run: scripts/test-relay-image-eligibility-workflow.sh
       - name: Desktop release candidate contract

.github/workflows/desktop-release-cache-proof.yml

@@ -12,7 +12,7 @@ jobs:
   macos:
     name: Prove macOS ${{ matrix.target }} cache visibility
     if: github.repository == 'block/buzz'
-    runs-on: macos-latest
+    runs-on: xcode-27
     timeout-minutes: 15
     strategy:
       fail-fast: false
@@ -28,6 +28,11 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
+      - name: Select pinned Xcode
+        run: |
+          export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
+          scripts/check-xcode.sh
+          echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - name: Patch proof dependency graph
         run: |

.github/workflows/macos-intel-canary.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     name: Build macOS Intel canary
     if: github.repository == 'block/buzz'
-    runs-on: macos-latest
+    runs-on: xcode-27
     timeout-minutes: 60
     env:
       TARGET: x86_64-apple-darwin
@@ -31,6 +31,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Select pinned Xcode
+        run: |
+          export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
+          scripts/check-xcode.sh
+          echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
 
       - name: Add Rust target

.github/workflows/release.yml

@@ -52,7 +52,7 @@ jobs:
   release:
     name: Release
     if: github.repository == 'block/buzz'
-    runs-on: macos-latest
+    runs-on: xcode-27
     needs: setup
     timeout-minutes: 60
     permissions:
@@ -70,6 +70,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Select pinned Xcode
+        run: |
+          export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
+          scripts/check-xcode.sh
+          echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
       - name: Verify tag-bound release source
         run: scripts/verify-release-ref.sh desktop-v "$VERSION"
 
@@ -108,7 +113,7 @@ jobs:
         uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ github.workspace }}/.cache/mesh-llama
-          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
+          key: mesh-llama-${{ runner.os }}-metal-${{ hashFiles('.xcode-version') }}-${{ steps.mesh_rev.outputs.rev }}
       - name: Build mesh llama native libraries
         if: steps.llama_cache.outputs.cache-hit != 'true'
         env:
@@ -132,7 +137,7 @@ jobs:
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ github.workspace }}/.cache/mesh-llama
-          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
+          key: mesh-llama-${{ runner.os }}-metal-${{ hashFiles('.xcode-version') }}-${{ steps.mesh_rev.outputs.rev }}
 
       - name: Build unsigned Tauri app
         run: cd desktop && pnpm tauri build --verbose --no-sign --features mesh-llm --config src-tauri/tauri.release.conf.json
@@ -265,7 +270,7 @@ jobs:
   release-macos-x64:
     name: Release macOS (Intel)
     if: github.repository == 'block/buzz'
-    runs-on: macos-latest
+    runs-on: xcode-27
     needs: setup
     timeout-minutes: 60
     permissions:
@@ -284,6 +289,11 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Select pinned Xcode
+        run: |
+          export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
+          scripts/check-xcode.sh
+          echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
       - name: Verify tag-bound release source
         run: scripts/verify-release-ref.sh desktop-v "$VERSION"
 

.github/workflows/signed-macos-canary.yml

@@ -13,7 +13,7 @@ jobs:
   build:
     name: Build signed macOS canary
     if: github.repository == 'block/buzz'
-    runs-on: macos-latest
+    runs-on: xcode-27
     timeout-minutes: 60
     permissions:
       contents: read
@@ -32,6 +32,11 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Select pinned Xcode
+        run: |
+          export DEVELOPER_DIR="/Applications/Xcode_$(cat .xcode-version).app/Contents/Developer"
+          scripts/check-xcode.sh
+          echo "DEVELOPER_DIR=$DEVELOPER_DIR" >> "$GITHUB_ENV"
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
 
       - name: Get pnpm store directory
@@ -133,7 +138,7 @@ jobs:
         uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ github.workspace }}/.cache/mesh-llama
-          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
+          key: mesh-llama-${{ runner.os }}-metal-${{ hashFiles('.xcode-version') }}-${{ steps.mesh_rev.outputs.rev }}
 
       - name: Build mesh llama native libraries
         if: steps.llama_cache.outputs.cache-hit != 'true'
@@ -158,7 +163,7 @@ jobs:
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ github.workspace }}/.cache/mesh-llama
-          key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
+          key: mesh-llama-${{ runner.os }}-metal-${{ hashFiles('.xcode-version') }}-${{ steps.mesh_rev.outputs.rev }}
 
       - name: Build unsigned Tauri app
         run: cd desktop && pnpm tauri build --verbose --no-sign --features mesh-llm --config src-tauri/tauri.canary.conf.json