[mbg]

Add-on to #4221 which adds a fallback for the Xcode version detection which calls out to xcrun.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

• Advanced setup - Impacts users who have custom CodeQL workflows.
• Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

• Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
• Code Quality - The changes impact analyses when analysis-kinds: code-quality.
• Other first-party - The changes impact other first-party analyses.

Environments:

• Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
• GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.

How will you know if something goes wrong after this change is released?

• Telemetry - I rely on existing telemetry or have made changes to the telemetry.
  • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
  • Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

🟡 Changes recommended

The fallback returns the macOS SDK version instead of the Xcode version, causing compatibility checks and diagnostics to use the wrong product version.

1 open issue

• Use Xcode product version instead of macOS SDK version · New

1 file not reviewed

• lib/entry-points.js: Excluded by your content exclusion settings

What changed in this PR

Adds an xcrun-based fallback to Xcode version detection, extending the platform compatibility checks introduced in #4221 for traced CodeQL analysis.

Changes:

• Separates symlink-based detection from the new command-based fallback.
• Makes Xcode version detection asynchronous and updates its caller.
• Adds tests for command output, failures, and fallback execution.

File	Description
src/​platform.ts	Adds the command-based fallback and asynchronous detection wrapper.
src/​platform.test.ts	Updates symlink tests and adds fallback coverage.
src/​languages/​traced.ts	Awaits Xcode detection before checking compatibility.

_{Review effort: Balanced (auto)}

[Copilot]

🟢 Approval recommended

No active review issues block approval of the macOS version-detection fallback changes.

No open issues 🎉

1 resolved since last review

• Use Xcode product version instead of macOS SDK version

1 file not reviewed

• lib/entry-points.js: Excluded by your content exclusion settings

_{Review effort: Balanced (auto)}

[henrymercer]

Two small things, otherwise LGTM