Fix Xcode archive preparation in PR builds

Add Xcode 27 to Tahoe images

.github/workflows/monthly.yml

@@ -58,6 +58,8 @@ jobs:
       max-parallel: 1
       matrix:
         include:
+          - macos_version: golden-gate
+            disable_sip_template: disable-sip-with-username.pkr.hcl
           - macos_version: sonoma
             disable_sip_template: disable-sip.pkr.hcl
           - macos_version: sequoia
@@ -115,9 +117,17 @@ jobs:
       matrix:
         include:
           - macos_version: tahoe
-            xcode_version: "26.2"
+            xcode_version: "27.1"
             xcode_components: '"MetalToolchain"'
             latest: true
+          - macos_version: tahoe
+            xcode_version: "27"
+            xcode_components: '"MetalToolchain"'
+            latest: false
+          - macos_version: tahoe
+            xcode_version: "26.2"
+            xcode_components: '"MetalToolchain"'
+            latest: false
           - macos_version: tahoe
             xcode_version: "26.1.1"
             xcode_components: '"MetalToolchain"'
@@ -158,6 +168,14 @@ jobs:
             xcode_version: "15.4"
             xcode_components: ""
             latest: false
+          - macos_version: golden-gate
+            xcode_version: "27.1"
+            xcode_components: '"MetalToolchain"'
+            latest: true
+          - macos_version: golden-gate
+            xcode_version: "27"
+            xcode_components: '"MetalToolchain"'
+            latest: false
     env:
       MACOS_VERSION: ${{ matrix.macos_version }}
       XCODE_COMPONENTS: ${{ matrix.xcode_components }}

.github/workflows/release.yml

@@ -34,10 +34,10 @@ jobs:
       fail-fast: false
       max-parallel: 1
       matrix:
-        # Xcode 27 requires macOS Tahoe 26.4 or later.
+        # Xcode 27 requires macOS Tahoe 26.6 or later.
         macos_version: >-
           ${{ startsWith(github.event.release.tag_name || inputs.xcode_version, '27')
-              && fromJSON('["tahoe"]')
+              && fromJSON('["tahoe", "golden-gate"]')
               || fromJSON('["tahoe", "sequoia"]') }}
     env:
       MACOS_VERSION: ${{ matrix.macos_version }}
@@ -100,6 +100,12 @@ jobs:
       max-parallel: 1
       matrix:
         include:
+          - macos_version: golden-gate
+            xcode_versions: '"27.1","27"'
+            additional_ios_builds: ""
+            additional_tvos_builds: ""
+            xcode_components: '"MetalToolchain"'
+            disk_size: 240
           - macos_version: sequoia
             xcode_versions: '"26.0.1",16.4,16.3,16.2,16.1,16'
             additional_ios_builds: "18.5,18.4,18.2,17.5"
@@ -107,7 +113,7 @@ jobs:
             xcode_components: '"MetalToolchain"'
             disk_size: 380
           - macos_version: tahoe
-            xcode_versions: '"26.6","27-beta-6","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
+            xcode_versions: '"27.1","26.6","27-beta-6","27","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
             additional_ios_builds: "18.6"
             additional_tvos_builds: ""
             xcode_components: '"MetalToolchain"'

.github/workflows/template-validation.yml

@@ -61,6 +61,8 @@ jobs:
           mkdir -p "$HOME/XcodesCache"
           touch "$HOME/XcodesCache/Xcode_26.6.xip"
           touch "$HOME/XcodesCache/Xcode_27-beta-6.xip"
+          touch "$HOME/XcodesCache/Xcode_27.xip"
+          touch "$HOME/XcodesCache/Xcode_27.1.xip"
 
       - name: Validate templates
         run: |
@@ -78,6 +80,12 @@ jobs:
             validate "$template"
           done
 
+          validate templates/xcode.pkr.hcl \
+            -var macos_version=golden-gate \
+            -var 'xcode_version=["27.1","27"]' \
+            -var 'xcode_components=["MetalToolchain"]' \
+            -var expected_runtimes_file=data/expected.golden-gate.runtimes.txt
+
           validate templates/base.pkr.hcl \
             -var vm_name=template-validation-base
 
@@ -106,6 +114,16 @@ jobs:
             -var 'xcode_version=["27-beta-6"]' \
             -var 'xcode_components=["MetalToolchain"]'
 
+          validate templates/xcode.pkr.hcl \
+            -var macos_version=tahoe \
+            -var 'xcode_version=["27"]' \
+            -var 'xcode_components=["MetalToolchain"]'
+
+          validate templates/xcode.pkr.hcl \
+            -var macos_version=tahoe \
+            -var 'xcode_version=["27.1"]' \
+            -var 'xcode_components=["MetalToolchain"]'
+
   build-vanilla:
     name: Build Vanilla Image (${{ matrix.macos_version }})
     needs: packer-validate
@@ -252,7 +270,7 @@ jobs:
       matrix:
         include:
           - macos_version: tahoe
-            xcode_versions: '"26.6","27-beta-6","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
+            xcode_versions: '"27.1","26.6","27-beta-6","27","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
             additional_ios_builds: "18.6"
             additional_tvos_builds: ""
             xcode_components: '"MetalToolchain"'
@@ -263,6 +281,12 @@ jobs:
             additional_tvos_builds: "17.5"
             xcode_components: '"MetalToolchain"'
             disk_size: 380
+          - macos_version: golden-gate
+            xcode_versions: '"27.1","27"'
+            additional_ios_builds: ""
+            additional_tvos_builds: ""
+            xcode_components: '"MetalToolchain"'
+            disk_size: 240
     env:
       ADDITIONAL_IOS_BUILDS: ${{ matrix.additional_ios_builds }}
       ADDITIONAL_TVOS_BUILDS: ${{ matrix.additional_tvos_builds }}
@@ -313,6 +337,7 @@ jobs:
 
       - name: Prepare Xcode archives
         if: steps.select.outputs.build == 'true'
+        timeout-minutes: 30
         run: |
           set -euo pipefail
 
@@ -323,6 +348,8 @@ jobs:
           fi
 
           mkdir -p "$HOME/XcodesCache"
+          download_dir="$(mktemp -d "$HOME/XcodesCache/.download.XXXXXX")"
+          trap 'rm -rf "$download_dir"' EXIT
           IFS=',' read -ra versions <<< "$XCODE_VERSIONS"
 
           for raw_version in "${versions[@]}"; do
@@ -335,35 +362,22 @@ jobs:
             fi
 
             echo "Downloading Xcode $version"
-            if [[ -z "${FASTLANE_SESSION:-}" ]]; then
-              echo "::error::Missing $target and FASTLANE_SESSION is not configured. Pre-cache the Xcode archive on the runner or add Apple Developer auth secrets."
+            download_args=(download "$version" --directory "$download_dir")
+            if [[ -n "${FASTLANE_SESSION:-}" ]]; then
+              download_args+=(--use-fastlane-auth)
+            elif [[ -n "${FASTLANE_USER:-}" ]]; then
+              # An explicit user reads a cookie file instead of FASTLANE_SESSION.
+              download_args+=(--use-fastlane-auth --fastlane-user "$FASTLANE_USER")
+            fi
+            xcodes "${download_args[@]}" < /dev/null
+
+            archives=("$download_dir"/*.xip)
+            if [[ ${#archives[@]} -ne 1 || ! -f "${archives[0]}" ]]; then
+              echo "::error::Expected exactly one downloaded Xcode archive for $version."
               exit 1
             fi
 
-            download_args=(download "$version" --directory "$HOME/XcodesCache" --use-fastlane-auth)
-            if [[ -n "${FASTLANE_USER:-}" ]]; then
-              download_args+=(--fastlane-user "$FASTLANE_USER")
-            fi
-            xcodes "${download_args[@]}"
-
-            candidate=""
-            case "$version" in
-              27-beta-6)
-                candidate="$HOME/XcodesCache/Xcode_27_beta_6.xip"
-                ;;
-              27-beta)
-                candidate="$HOME/XcodesCache/Xcode_27_beta.xip"
-                ;;
-              *)
-                candidate="$(find "$HOME/XcodesCache" -maxdepth 1 -type f -name "Xcode_${version}*.xip" -print -quit)"
-                ;;
-            esac
-
-            if [[ -n "$candidate" && -f "$candidate" && "$candidate" != "$target" ]]; then
-              mv "$candidate" "$target"
-            fi
-
-            test -f "$target"
+            mv "${archives[0]}" "$target"
           done
 
       - name: Build runner image

README.md

@@ -7,8 +7,8 @@ The following image variants are currently available:
 
 * `macos-{golden-gate,tahoe,sequoia,sonoma}-vanilla` — a vanilla macOS installation with helpful tweaks such as auto-login, but no additional software preinstalled
 * `macos-{golden-gate,tahoe,sequoia,sonoma}-base` — based on `macos-{golden-gate,tahoe,sequoia,sonoma}-vanilla` image, it comes with `brew` and [other useful software](https://github.com/cirruslabs/macos-image-templates/blob/main/templates/base.pkr.hcl) pre-installed, but without Xcode
-* `macos-{tahoe,sequoia,sonoma}-xcode:N` — based on `macos-{tahoe,sequoia,sonoma}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
-* `macos-runner:{tahoe,sequoia,sonoma}` — a variant of `xcode:N` with several versions of `Xcode` pre-installed and [`xcodes` tool](https://github.com/XcodesOrg/xcodes) to switch between them.
+* `macos-{golden-gate,tahoe,sequoia,sonoma}-xcode:N` — based on `macos-{golden-gate,tahoe,sequoia,sonoma}-base` image and has `Xcode N` with [`Flutter`](https://flutter.dev/) pre-installed
+* `macos-runner:{golden-gate,tahoe,sequoia,sonoma}` — a variant of `xcode:N` with one or more versions of `Xcode` pre-installed and [`xcodes` tool](https://github.com/XcodesOrg/xcodes) to switch between them.
 
 See a full list of VMs available [here](https://github.com/orgs/cirruslabs/packages?tab=packages&q=macos-).
 
@@ -44,7 +44,7 @@ on the host, guest, and workload.
 ## Release Cadence
 
 Once a new version of Xcode is released, we will initiate a GitHub release which will automatically build and push
-a new version of the `macos-{tahoe,sequoia}-xcode:N`. This generally happens the next weekend after a release.
+a new version of the `macos-{golden-gate,tahoe,sequoia}-xcode:N` images on supported macOS versions. This generally happens the next weekend after a release.
 Please watch this repository releases to get notified about new images.
 
 ## Update Cadence

data/expected.golden-gate.runtimes.txt

@@ -0,0 +1,6 @@
+== Runtimes ==
+iOS 27.0 (27.0 - 24A434) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
+iOS 27.1 (27.1 - 24A94425) - com.apple.CoreSimulator.SimRuntime.iOS-27-1
+tvOS 27.0 (27.0 - 24J360) - com.apple.CoreSimulator.SimRuntime.tvOS-27-0
+watchOS 27.0 (27.0 - 24R362) - com.apple.CoreSimulator.SimRuntime.watchOS-27-0
+visionOS 27.0 (27.0 - 24M362) - com.apple.CoreSimulator.SimRuntime.xrOS-27-0

data/expected.tahoe.runtimes.txt

@@ -7,9 +7,14 @@ iOS 26.4 (26.4.1 - 23E254a) - com.apple.CoreSimulator.SimRuntime.iOS-26-4
 iOS 26.5 (26.5 - 23F77) - com.apple.CoreSimulator.SimRuntime.iOS-26-5
 iOS 27.0 (27.0 - 24A5355p) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
 iOS 27.0 (27.0 - 24A5423a) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
+iOS 27.0 (27.0 - 24A434) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
+iOS 27.1 (27.1 - 24A94425) - com.apple.CoreSimulator.SimRuntime.iOS-27-1
 tvOS 26.5 (26.5 - 23L470) - com.apple.CoreSimulator.SimRuntime.tvOS-26-5
 tvOS 27.0 (27.0 - 24J5356a) - com.apple.CoreSimulator.SimRuntime.tvOS-27-0
+tvOS 27.0 (27.0 - 24J360) - com.apple.CoreSimulator.SimRuntime.tvOS-27-0
 watchOS 26.5 (26.5 - 23T570) - com.apple.CoreSimulator.SimRuntime.watchOS-26-5
 watchOS 27.0 (27.0 - 24R5355a) - com.apple.CoreSimulator.SimRuntime.watchOS-27-0
+watchOS 27.0 (27.0 - 24R362) - com.apple.CoreSimulator.SimRuntime.watchOS-27-0
 visionOS 26.5 (26.5 - 23O470) - com.apple.CoreSimulator.SimRuntime.xrOS-26-5
 visionOS 27.0 (27.0 - 24M5357a) - com.apple.CoreSimulator.SimRuntime.xrOS-27-0
+visionOS 27.0 (27.0 - 24M362) - com.apple.CoreSimulator.SimRuntime.xrOS-27-0

templates/vanilla-golden-gate.pkr.hcl

@@ -12,7 +12,7 @@ packer {
 }
 
 source "tart-cli" "tart" {
-  from_ipsw    = "https://updates.cdn-apple.com/2026SummerSeed/7b1c2bd9-7617-426d-92e5-ef204407ffaa/UniversalMac_27.0_26A5416b_Restore.ipsw"
+  from_ipsw    = "https://updates.cdn-apple.com/2026FallFCS/afcfc88e-bbe6-44bf-a5da-07c56eebc06c/UniversalMac_27.0_26A428_Restore.ipsw"
   vm_name      = "golden-gate-vanilla"
   cpu_count    = 4
   memory_gb    = 8
@@ -53,6 +53,16 @@ source "tart-cli" "tart" {
     "<wait10s><leftShiftOn><tab><leftShiftOff><wait1s><spacebar>",
     # Quit System Settings
     "<wait10s><leftAltOn>q<leftAltOff>",
+    # Refocus Terminal after quitting System Settings
+    "<wait10s><leftAltOn><spacebar><leftAltOff>Terminal<wait10s><enter>",
+    # Sharing is no longer listed in the View menu on Golden Gate
+    "<wait10s>open 'x-apple.systempreferences:com.apple.Sharing-Settings.extension'<enter>",
+    # Enable Screen Sharing through the UI to grant the required TCC permissions
+    "<wait10s><tab><tab><tab><tab><tab><tab><spacebar>",
+    # Type in the password to allow enabling Screen Sharing
+    "<wait10s>admin<enter>",
+    # Quit System Settings
+    "<wait10s><leftAltOn>q<leftAltOff>",
   ]
 
   // A (hopefully) temporary workaround for Virtualization.Framework's
@@ -70,8 +80,6 @@ build {
     inline = [
       // Enable passwordless sudo
       "echo admin | sudo -S sh -c \"mkdir -p /etc/sudoers.d/; echo 'admin ALL=(ALL) NOPASSWD: ALL' | EDITOR=tee visudo /etc/sudoers.d/admin-nopasswd\"",
-      // Enable Screen Sharing for "tart run --vnc"
-      "sudo launchctl enable system/com.apple.screensharing",
       // Use the same timezone as the previous Setup Assistant flow
       "sudo systemsetup -settimezone GMT 2>/dev/null",
       // Disable screensaver at login screen
@@ -100,6 +108,8 @@ build {
     inline = [
       # Ensure that Gatekeeper is disabled
       "spctl --status | grep -q 'assessments disabled'",
+      # Ensure that Screen Sharing was enabled
+      "sudo launchctl print system/com.apple.screensharing > /dev/null",
       # Ensure that FileVault remains disabled by default
       "sudo fdesetup status | grep -q 'FileVault is Off'",
     ]

templates/xcode.pkr.hcl

@@ -191,14 +191,7 @@ build {
     }
   }
 
-  provisioner "shell" {
-    inline = [
-      "source ~/.zprofile",
-      "sudo xcode-select -s /Applications/Xcode_${var.xcode_version[0]}.app/Contents/Developer",
-      "xcodebuild -downloadAllPlatforms",
-    ]
-  }
-
+  // Download legacy iOS runtimes before selecting the newest Xcode.
   provisioner "shell" {
     inline = concat(
       ["source ~/.zprofile"],
@@ -208,6 +201,14 @@ build {
     )
   }
 
+  provisioner "shell" {
+    inline = [
+      "source ~/.zprofile",
+      "sudo xcode-select -s /Applications/Xcode_${var.xcode_version[0]}.app/Contents/Developer",
+      "xcodebuild -downloadAllPlatforms",
+    ]
+  }
+
   provisioner "shell" {
     inline = concat(
       ["source ~/.zprofile"],