CI on macOS 27: ci-macos, ci-macos-e2e and both fresh-install channels

GitHub serves macOS 27 under the preview label xcode-27 (macOS 27.0 with Xcode
27, actions/runner-images#14404); there is no macos-27 label. Measured on #658:
the label delivers macOS 27.0 (26A5406e), arm64, ImageOS macos27.

- ci-macos and ci-macos-e2e run on macos-15 and xcode-27.
- ci-fresh-install runs the xlings and Homebrew channels on macos-14 (the
  floor) and xcode-27 (the newest release).
- Every macOS 27 leg asserts sw_vers major 27, because the label names an
  Xcode and its base OS has changed once.
- setup-macos-llvm takes the image as an input and puts it in the xlings cache
  key, which named macos15 for every image.

Author: speak-agent

.agents/docs/2026-09-17-655-implementation-plan.md

@@ -165,7 +165,8 @@ reason).
 | E7 | `build/flag-words` note on the first plan | E1 | branch: e2e 736 D and E |
 | E8 | SPEC-004 §8, SPEC-005 R3.7, docs/04 and docs/30 with their Chinese mirrors, CHANGELOG | E1-E7 | branch |
 | E9 | version 2026.9.17.1 | - | branch |
-| E10 | CI green on every workflow of the pull request | E1-E9 | todo |
+| E10 | CI green on every workflow of the pull request | E1-E9, E11 | todo |
+| E11 | macOS 27 legs (maintainer request, 2026-09-17; label measured in §5.1): `ci-macos` and `ci-macos-e2e` run on `macos-15` and macOS 27; `ci-fresh-install` runs its xlings and Homebrew channels on `macos-14` and macOS 27; each macOS 27 leg asserts `sw_vers` major 27 | - | branch |
 
 ### 3.2 Release and ecosystem, in order
 
@@ -227,6 +228,21 @@ Recorded after the release in §7.
 
 Recorded as each row closes.
 
+## 5.1 macOS 27 on GitHub-hosted runners
+
+GitHub publishes no `macos-27` label. The runner-images README (read on
+2026-09-17) lists macOS 26 as the newest GA image (`macos-26`, `macos-latest`)
+and macOS 14 as deprecated (unsupported from 2026-11-02). macOS 27 is served as
+the preview label `xcode-27`, whose base OS moved from macOS 26 to macOS 27.0 on
+2026-09-16 (actions/runner-images#14404), with a warning that capacity may
+queue. A temporary pull request (#658) measured which labels are served; its
+first run, naming `macos-27`, `macos-27-arm64`, `macos-26` and `macos-latest`,
+was cancelled while every job was still queued behind this repository's runner
+limit, and the second names `xcode-27` and reads
+`label=xcode-27 27.0 build=26A5406e arch=arm64 xcode=Xcode 27.0 clang=Apple clang
+version 21.0.0` with `ImageOS=macos27` (run on 2026-09-16T19:16Z). Because the label names an Xcode and its
+base OS has changed once, every macOS 27 leg asserts that `sw_vers` reports 27.
+
 ## 8. Residuals
 
 - `ldflags`, `dialect_cxxflags` and `std-module-flags` keep their current

.github/actions/setup-macos-llvm/action.yml

@@ -16,6 +16,13 @@ inputs:
     # .github/actions/bootstrap-mcpp/action.yml for why 0.4.69 is required
     # (two packages named `lua` in one repo need openxlings/xlings#381).
     default: '2026.9.16.1'
+  image:
+    description: >
+      The runner label the job runs on (macos-15, xcode-27). It is part of the
+      xlings cache key: the cache holds installed binaries, and a key that does
+      not name the OS release lets one image restore what another installed.
+    required: false
+    default: 'macos-15'
 
 runs:
   using: composite
@@ -24,9 +31,9 @@ runs:
       uses: actions/cache@v4
       with:
         path: ~/.xlings
-        key: xlings-macos15-arm64-v3-xl${{ inputs.xlings-version }}-${{ hashFiles('.xlings.json') }}
+        key: xlings-${{ inputs.image }}-arm64-v3-xl${{ inputs.xlings-version }}-${{ hashFiles('.xlings.json') }}
         restore-keys: |
-          xlings-macos15-arm64-v3-xl${{ inputs.xlings-version }}-
+          xlings-${{ inputs.image }}-arm64-v3-xl${{ inputs.xlings-version }}-
 
     - name: Bootstrap xlings
       shell: bash

.github/workflows/ci-fresh-install.yml

@@ -357,13 +357,25 @@ jobs:
   # ──────────────────────────────────────────────────────────────────
   macos-fresh:
     needs: [wait-index]
-    name: macOS fresh install
+    name: macOS fresh install (${{ matrix.image }})
     if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
+    # Two images, the two ends of the supported range.
+    #
     # macos-14: the support floor (mcpp ≥0.0.50 / xlings ≥0.4.50 ship
     # minos=14.0 static-libc++ binaries). A fresh install passing here
     # is the continuous proof of the macOS 14 floor — and of host-tool
     # independence (this image has no sha256sum; macos-15 does).
-    runs-on: macos-14
+    #
+    # xcode-27: macOS 27, the newest release, served under the preview label
+    # `xcode-27` (actions/runner-images#14404; there is no `macos-27` label).
+    # The same released binaries, the same steps; a failure only here is a
+    # change in the newest system (SDK, loader, system libc++ headers) that the
+    # floor cannot show.
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [macos-14, xcode-27]
+    runs-on: ${{ matrix.image }}
     timeout-minutes: 30
     env:
       # The one derived value (see the header comment): every install job names
@@ -372,6 +384,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: The image is the macOS it names
+        run: |
+          echo "macOS $(sw_vers -productVersion) | $(uname -m)"
+          # See ci-macos.yml: `xcode-27` names an Xcode, not an OS.
+          if [ "${{ matrix.image }}" = xcode-27 ]; then
+            [ "$(sw_vers -productVersion | cut -d. -f1)" = 27 ] || { echo "::error::xcode-27 delivered macOS $(sw_vers -productVersion), not 27"; exit 1; }
+          fi
+
       - name: Install xlings
         env:
           XLINGS_NON_INTERACTIVE: '1'
@@ -452,16 +472,24 @@ jobs:
   #   channel healthy the entire time. So the trust gate itself is asserted
   #   from BOTH sides: refused before `brew trust`, accepted after.
   macos-brew-fresh:
-    name: macOS fresh install (Homebrew)
+    name: macOS fresh install (Homebrew, ${{ matrix.image }})
     if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }}
-    # Same floor as macos-fresh: the formula declares `depends_on macos:
-    # :sonoma` + arm64, and macos-14 is the oldest image satisfying it.
-    runs-on: macos-14
+    # Same two images as macos-fresh: the formula declares `depends_on macos:
+    # :sonoma` + arm64, macos-14 is the oldest image satisfying it, and
+    # xcode-27 is macOS 27, the newest release.
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [macos-14, xcode-27]
+    runs-on: ${{ matrix.image }}
     timeout-minutes: 30
     steps:
       - name: Environment
         run: |
           echo "macOS $(sw_vers -productVersion) | $(uname -m) | $(brew --version | head -1)"
+          if [ "${{ matrix.image }}" = xcode-27 ]; then
+            [ "$(sw_vers -productVersion | cut -d. -f1)" = 27 ] || { echo "::error::xcode-27 delivered macOS $(sw_vers -productVersion), not 27"; exit 1; }
+          fi
 
       # ① The command README.md documents, on a machine that has never tapped.
       #    Fully qualified, so Homebrew treats it as explicit intent.

.github/workflows/ci-macos-e2e.yml

@@ -22,8 +22,13 @@ concurrency:
 
 jobs:
   e2e:
-    name: e2e suite (macOS ARM64, self-host)
-    runs-on: macos-15
+    name: e2e suite (macOS ARM64, self-host, ${{ matrix.image }})
+    # The same two images as ci-macos.yml; `xcode-27` is macOS 27 (see there).
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [macos-15, xcode-27]
+    runs-on: ${{ matrix.image }}
     timeout-minutes: 60
     # NOTE: no MCPP_VERBOSE — the e2e suite asserts mcpp's default quiet
     # output (tests 48/53).
@@ -37,6 +42,8 @@ jobs:
         with:
           submodules: recursive
       - uses: ./.github/actions/setup-macos-llvm
+        with:
+          image: ${{ matrix.image }}
 
       - name: Build mcpp from source (self-host)
         run: |

.github/workflows/ci-macos.yml

@@ -19,9 +19,22 @@ concurrency:
 
 jobs:
   macos-xlings-llvm:
-    name: macOS ARM64 — xlings LLVM end-to-end
-    runs-on: macos-15
-    timeout-minutes: 30
+    name: macOS ARM64 — xlings LLVM end-to-end (${{ matrix.image }})
+    # Two images: macos-15, the image every other macOS job uses, and macOS 27,
+    # the newest macOS release. The newest release is where a change of the SDK,
+    # the system libc++ headers or the loader first shows; the packaged binaries
+    # carry minos=14.0, and ci-fresh-install covers that floor.
+    #
+    # GitHub serves macOS 27 under the preview label `xcode-27` (macOS 27.0 with
+    # Xcode 27, actions/runner-images#14404); there is no `macos-27` label, and
+    # a job naming one waits for a runner that never comes. The "System info"
+    # step prints the OS the label delivered.
+    strategy:
+      fail-fast: false
+      matrix:
+        image: [macos-15, xcode-27]
+    runs-on: ${{ matrix.image }}
+    timeout-minutes: 45
     # NOTE: no MCPP_VERBOSE here — keep this job's output shape identical to
     # ci-macos-e2e.yml, which asserts mcpp's default quiet output (48/53).
     steps:
@@ -31,10 +44,18 @@ jobs:
         run: |
           uname -a
           sw_vers
+          # `xcode-27` names an Xcode, not an OS, and the image changed its base
+          # OS once already; the leg exists for macOS 27, so it says so or fails.
+          if [ "${{ matrix.image }}" = xcode-27 ]; then
+            major=$(sw_vers -productVersion | cut -d. -f1)
+            [ "$major" = 27 ] || { echo "::error::xcode-27 delivered macOS $(sw_vers -productVersion), not 27"; exit 1; }
+          fi
           xcrun --show-sdk-path
           echo "SDK: $(xcrun --show-sdk-version)"
 
       - uses: ./.github/actions/setup-macos-llvm
+        with:
+          image: ${{ matrix.image }}
 
       - name: Inspect LLVM package structure
         run: |

CHANGELOG.md

@@ -29,6 +29,10 @@ libarchive、bzip2、lz4、xz、zlib 与 zstd 的每个 C 文件都无法解析
   这样的元素。
 - Windows 上 `shell_quote_arg` 按 MSVCRT 规则加倍引号前与结尾处的反斜杠,以 `\` 结尾的
   词不再吞掉闭合引号。
+- **CI 覆盖 macOS 27。** `ci-macos` 与 `ci-macos-e2e` 在 `macos-15` 与 macOS 27 上各跑一遍,
+  `ci-fresh-install` 的 xlings 与 Homebrew 两条安装渠道在 `macos-14` 与 macOS 27 上各跑一遍。
+  GitHub 以预览标签 `xcode-27` 提供 macOS 27(无 `macos-27` 标签),每条 macOS 27 的腿断言
+  `sw_vers` 主版本为 27。
 
 ### 内置 xlings 升至 2026.9.16.1(2026.9.16.2)