Avoid concurrent APFS resizing in Xcode image builds

* Add Xcode 27.1 to Tahoe and Golden Gate images

* Fix Xcode archive preparation in PR builds

.github/workflows/monthly.yml

@@ -117,9 +117,13 @@ jobs:
       matrix:
         include:
           - macos_version: tahoe
-            xcode_version: "27"
+            xcode_version: "27.1"
             xcode_components: '"MetalToolchain"'
             latest: true
+          - macos_version: tahoe
+            xcode_version: "27"
+            xcode_components: '"MetalToolchain"'
+            latest: false
           - macos_version: tahoe
             xcode_version: "26.2"
             xcode_components: '"MetalToolchain"'
@@ -165,9 +169,13 @@ jobs:
             xcode_components: ""
             latest: false
           - macos_version: golden-gate
-            xcode_version: "27"
+            xcode_version: "27.1"
             xcode_components: '"MetalToolchain"'
             latest: true
+          - macos_version: golden-gate
+            xcode_version: "27"
+            xcode_components: '"MetalToolchain"'
+            latest: false
     env:
       MACOS_VERSION: ${{ matrix.macos_version }}
       XCODE_COMPONENTS: ${{ matrix.xcode_components }}
@@ -189,6 +197,8 @@ jobs:
 
       - name: Build Xcode image
         run: |
+          tart clone "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest" "$MACOS_VERSION-xcode:$XCODE_VERSION"
+          tart set "$MACOS_VERSION-xcode:$XCODE_VERSION" --disk-size 140
           packer init templates/xcode.pkr.hcl
           packer build \
             -var "macos_version=$MACOS_VERSION" \

.github/workflows/release.yml

@@ -66,6 +66,8 @@ jobs:
 
       - name: Build release image
         run: |
+          tart clone "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest" "$MACOS_VERSION-xcode:$XCODE_RELEASE_VERSION"
+          tart set "$MACOS_VERSION-xcode:$XCODE_RELEASE_VERSION" --disk-size 140
           packer init templates/xcode.pkr.hcl
           packer build \
             -var "macos_version=$MACOS_VERSION" \
@@ -101,7 +103,7 @@ jobs:
       matrix:
         include:
           - macos_version: golden-gate
-            xcode_versions: '"27"'
+            xcode_versions: '"27.1","27"'
             additional_ios_builds: ""
             additional_tvos_builds: ""
             xcode_components: '"MetalToolchain"'
@@ -113,7 +115,7 @@ jobs:
             xcode_components: '"MetalToolchain"'
             disk_size: 380
           - macos_version: tahoe
-            xcode_versions: '"27","26.6","27-beta-6","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
+            xcode_versions: '"27.1","26.6","27-beta-6","27","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
             additional_ios_builds: "18.6"
             additional_tvos_builds: ""
             xcode_components: '"MetalToolchain"'
@@ -141,6 +143,8 @@ jobs:
 
       - name: Build runner image
         run: |
+          tart clone "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest" "$MACOS_VERSION-xcode:runner"
+          tart set "$MACOS_VERSION-xcode:runner" --disk-size "$DISK_SIZE"
           packer init templates/xcode.pkr.hcl
           packer build \
             -var tag=runner \

.github/workflows/template-validation.yml

@@ -62,6 +62,7 @@ jobs:
           touch "$HOME/XcodesCache/Xcode_26.6.xip"
           touch "$HOME/XcodesCache/Xcode_27-beta-6.xip"
           touch "$HOME/XcodesCache/Xcode_27.xip"
+          touch "$HOME/XcodesCache/Xcode_27.1.xip"
 
       - name: Validate templates
         run: |
@@ -81,7 +82,7 @@ jobs:
 
           validate templates/xcode.pkr.hcl \
             -var macos_version=golden-gate \
-            -var 'xcode_version=["27"]' \
+            -var 'xcode_version=["27.1","27"]' \
             -var 'xcode_components=["MetalToolchain"]' \
             -var expected_runtimes_file=data/expected.golden-gate.runtimes.txt
 
@@ -118,6 +119,11 @@ jobs:
             -var 'xcode_version=["27"]' \
             -var 'xcode_components=["MetalToolchain"]'
 
+          validate templates/xcode.pkr.hcl \
+            -var macos_version=tahoe \
+            -var 'xcode_version=["27.1"]' \
+            -var 'xcode_components=["MetalToolchain"]'
+
   build-vanilla:
     name: Build Vanilla Image (${{ matrix.macos_version }})
     needs: packer-validate
@@ -264,7 +270,7 @@ jobs:
       matrix:
         include:
           - macos_version: tahoe
-            xcode_versions: '"27","26.6","27-beta-6","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
+            xcode_versions: '"27.1","26.6","27-beta-6","27","26.5","27-beta","26.4.1","26.3","26.2","26.1.1","26.0.1"'
             additional_ios_builds: "18.6"
             additional_tvos_builds: ""
             xcode_components: '"MetalToolchain"'
@@ -276,7 +282,7 @@ jobs:
             xcode_components: '"MetalToolchain"'
             disk_size: 380
           - macos_version: golden-gate
-            xcode_versions: '"27"'
+            xcode_versions: '"27.1","27"'
             additional_ios_builds: ""
             additional_tvos_builds: ""
             xcode_components: '"MetalToolchain"'
@@ -331,6 +337,7 @@ jobs:
 
       - name: Prepare Xcode archives
         if: steps.select.outputs.build == 'true'
+        timeout-minutes: 30
         run: |
           set -euo pipefail
 
@@ -341,6 +348,8 @@ jobs:
           fi
 
           mkdir -p "$HOME/XcodesCache"
+          download_dir="$(mktemp -d "$HOME/XcodesCache/.download.XXXXXX")"
+          trap 'rm -rf "$download_dir"' EXIT
           IFS=',' read -ra versions <<< "$XCODE_VERSIONS"
 
           for raw_version in "${versions[@]}"; do
@@ -353,43 +362,29 @@ jobs:
             fi
 
             echo "Downloading Xcode $version"
-            if [[ -z "${FASTLANE_SESSION:-}" ]]; then
+            download_args=(download "$version" --directory "$download_dir")
-              echo "::error::Missing $target and FASTLANE_SESSION is not configured. Pre-cache the Xcode archive on the runner or add Apple Developer auth secrets."
+            if [[ -n "${FASTLANE_SESSION:-}" ]]; then
+              download_args+=(--use-fastlane-auth)
+            elif [[ -n "${FASTLANE_USER:-}" ]]; then
+              # An explicit user reads a cookie file instead of FASTLANE_SESSION.
+              download_args+=(--use-fastlane-auth --fastlane-user "$FASTLANE_USER")
+            fi
+            xcodes "${download_args[@]}" < /dev/null
+
+            archives=("$download_dir"/*.xip)
+            if [[ ${#archives[@]} -ne 1 || ! -f "${archives[0]}" ]]; then
+              echo "::error::Expected exactly one downloaded Xcode archive for $version."
               exit 1
             fi
 
-            download_args=(download "$version" --directory "$HOME/XcodesCache" --use-fastlane-auth)
+            mv "${archives[0]}" "$target"
-            if [[ -n "${FASTLANE_USER:-}" ]]; then
-              download_args+=(--fastlane-user "$FASTLANE_USER")
-            fi
-            xcodes "${download_args[@]}"
-
-            candidate=""
-            case "$version" in
-              27)
-                candidate="$HOME/XcodesCache/Xcode_27.0.xip"
-                ;;
-              27-beta-6)
-                candidate="$HOME/XcodesCache/Xcode_27_beta_6.xip"
-                ;;
-              27-beta)
-                candidate="$HOME/XcodesCache/Xcode_27_beta.xip"
-                ;;
-              *)
-                candidate="$(find "$HOME/XcodesCache" -maxdepth 1 -type f -name "Xcode_${version}*.xip" -print -quit)"
-                ;;
-            esac
-
-            if [[ -n "$candidate" && -f "$candidate" && "$candidate" != "$target" ]]; then
-              mv "$candidate" "$target"
-            fi
-
-            test -f "$target"
           done
 
       - name: Build runner image
         if: steps.select.outputs.build == 'true'
         run: |
+          tart clone "ghcr.io/cirruslabs/macos-$MACOS_VERSION-base:latest" "$MACOS_VERSION-xcode:runner"
+          tart set "$MACOS_VERSION-xcode:runner" --disk-size "$DISK_SIZE"
           packer init templates/xcode.pkr.hcl
           packer build \
             -var tag=runner \

data/expected.golden-gate.runtimes.txt

@@ -1,5 +1,6 @@
 == Runtimes ==
 iOS 27.0 (27.0 - 24A434) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
+iOS 27.1 (27.1 - 24A94425) - com.apple.CoreSimulator.SimRuntime.iOS-27-1
 tvOS 27.0 (27.0 - 24J360) - com.apple.CoreSimulator.SimRuntime.tvOS-27-0
 watchOS 27.0 (27.0 - 24R362) - com.apple.CoreSimulator.SimRuntime.watchOS-27-0
 visionOS 27.0 (27.0 - 24M362) - com.apple.CoreSimulator.SimRuntime.xrOS-27-0

data/expected.tahoe.runtimes.txt

@@ -8,6 +8,7 @@ iOS 26.5 (26.5 - 23F77) - com.apple.CoreSimulator.SimRuntime.iOS-26-5
 iOS 27.0 (27.0 - 24A5355p) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
 iOS 27.0 (27.0 - 24A5423a) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
 iOS 27.0 (27.0 - 24A434) - com.apple.CoreSimulator.SimRuntime.iOS-27-0
+iOS 27.1 (27.1 - 24A94425) - com.apple.CoreSimulator.SimRuntime.iOS-27-1
 tvOS 26.5 (26.5 - 23L470) - com.apple.CoreSimulator.SimRuntime.tvOS-26-5
 tvOS 27.0 (27.0 - 24J5356a) - com.apple.CoreSimulator.SimRuntime.tvOS-27-0
 tvOS 27.0 (27.0 - 24J360) - com.apple.CoreSimulator.SimRuntime.tvOS-27-0

templates/xcode.pkr.hcl

@@ -58,12 +58,12 @@ variable "android_sdk_tools_version" {
 }
 
 source "tart-cli" "tart" {
-  vm_base_name = "ghcr.io/cirruslabs/macos-${var.macos_version}-base:latest"
+  // The workflow sizes the VM before boot; only the guest daemon resizes APFS.
+  recovery_partition = "keep"
   // use tag or the last element of the xcode_version list
   vm_name      = "${var.macos_version}-xcode:${var.tag != "" ? var.tag : var.xcode_version[0]}"
   cpu_count    = 4
   memory_gb    = 8
-  disk_size_gb = var.disk_size
   headless     = true
   ssh_password = "admin"
   ssh_username = "admin"
@@ -95,7 +95,15 @@ build {
   sources = ["source.tart-cli.tart"]
 
   provisioner "shell" {
+    // Allow 6 GB for boot/recovery partitions and metadata; Tart uses decimal GB.
     inline = [
+      "minimum_kb=${floor((var.disk_size - 6) * 1000000000 / 1024)}",
+      "for ((attempt = 0; attempt < 60; attempt++)); do",
+      "  size_kb=$(df -k /System/Volumes/Data | awk 'NR == 2 {print $2}')",
+      "  [[ $size_kb -ge $minimum_kb ]] && break",
+      "  sleep 2",
+      "done",
+      "[[ $size_kb -ge $minimum_kb ]] || { echo 'APFS did not expand to ${var.disk_size} GB within 120 seconds.' >&2; exit 1; }",
       "source ~/.zprofile",
       "brew --version",
       "brew update",