Skip to main content

Frequently asked questions

This page lists typical problems with their cause and solution.

swift-format is unavailable and .swift files end with exit 6​

CodeGuard finds swift-format via xcrun, but only launches it if the path is under a trusted directory of the organization policy. A standard Xcode installation ships it under …/XcodeDefault.xctoolchain/usr/bin, which is not one of the built-in directories. Install a policy with this directory in trusted_roots (see Getting started). A project configuration cannot fix this.

Every run ends with exit 3, even though nothing has changed​

Usually swiftlint is missing. checks.swiftlint is mandatory by default. Put a root-owned copy in /usr/local/bin and use codeguard doctor to check that swiftlint: active appears. You can disable SwiftLint organization-wide only via locked_values in the organization policy.

compile reports codeguard-dependency-unavailable and exit 3​

Your Swift package has remote dependencies. CodeGuard builds offline with an empty dependency cache, so SwiftPM cannot fetch them. In 0.3.5, there is no way to provide dependencies offline. Remove compile and tests for this project:

version: 1
checks:
  compile: { scopes: [] }
  tests:   { scopes: [] }

check-diff ends with exit 6 and codeguard-build-execution-denied​

compile and tests need approval. Locally: check codeguard trust status, then run codeguard trust grant. In CI: check the attestation on the runner (see Organization policy). The message in the report states the reason, such as project trust is not-trusted, project trust is invalid or no declaration is installed at the organisation's execution-environment path.

My trust ticket is suddenly invalid​

A bound input has changed: .codeguard.yml, Package.swift, the Xcode project, the scheme, .xcconfig, the organization policy or the way you use --config/--no-project-config. Run codeguard trust grant again. Details in Trust and security.

Can I disable a check in my .codeguard.yml?​

For checks.platform, yes. For format, swiftlint, compile, tests and security, enabled: false and required: false are forbidden at the project level (exit 2). You can, however, remove the check from all runs with scopes: []. Anything beyond that is up to the organization policy.

Why is execution.timeouts in my project file an error?​

The project level must not set timeouts, max_workers, security.* or tools.* (exit 2: configuration source is not allowed to set this field). The organization sets them via locked_values. execution.analysis_limits.*, on the other hand, is allowed.

My .codeguard.yml is not loaded​

  • It must be in the project root directory (current directory or --project-root). CodeGuard does not search parent folders.
  • The name must be exactly .codeguard.yml or .codeguard.yaml, in lowercase.
  • If both files are there, that is exit 2.
  • With --no-project-config, it is deliberately ignored, and the report then shows Konfiguration: Standardwerte (--no-project-config).

The line Konfiguration: .codeguard.yml (auto, sha256 …) in the text report shows whether it was loaded.

Every line reports [Indentation] from swift-format​

Without a project file, swift-format uses its defaults (2-space indentation). Put a .swift-format file with your style in the root directory, e.g. {"version": 1, "indentation": {"spaces": 4}, "lineLength": 120}. See Checks and rules.

Why does the same error appear twice?​

CodeGuard content rules and SwiftLint can report the same location, such as forbidden-force-try and swiftlint.force_try. These are two separate findings from two tools. Both disappear when you fix the location. If you want only one, disable the SwiftLint rule in .swiftlint.yml or set the CodeGuard rule in rules to enabled: false, unless the organization lists it as a mandatory rule.

Test data with sample tokens triggers hardcoded-secret​

Options, in this order:

  1. Use placeholders (<TOKEN>, YOUR_…, changeme).
  2. Exclude paths: rules.hardcoded-secret.path_overrides with enabled: false for e.g. Tests/Fixtures/**.
  3. Permanently allow a specific value: rules.hardcoded-secret.allowlist_sha256 (applies only to the format and URL stage).

There is no suppression via comments.

Exit 3 with codeguard-content-scan-incomplete​

A file could not be evaluated safely, e.g. too large, not valid UTF-8 or unparseable JSON/plist (structureUnparseable, such as JSON with comments). Because checks.security is mandatory, this becomes exit 3. Exclude such files via paths.exclude or increase the matching execution.analysis_limits.

Exit 3 for a watchOS or tvOS app​

There is no matching simulator runtime, and without macOS among the built platforms, no test target is left. Install the runtime and check with codeguard doctor (simulator.watchos: available). Alternatives: remove tests with scopes: [], or lock checks.tests.required: false organization-wide.

check-diff aborts in a monorepo​

The project root must be the root of the Git repository. You can check a project in a subfolder with check-file and check-project (with --project-root), but not with check-diff.

check-diff reports 0 changed files and exit 0​

There were no changes compared to the base (termination_reason: no_changes). Note: without --base and --staged, check-diff compares the working directory with the index. Changes that are already staged are then missing. New files count only with --include-untracked.

A pull request that changes the CI file is blocked​

.github/workflows/**, .gitlab-ci.yml, .codeguard.yml, Package.swift and others are protected files. A diff that changes them ends with exit 6 (protected_file). This is intentional; such changes need human review.

Exit 4 with codeguard-tool-output-unparseable​

CodeGuard could not reliably read a tool's output and never treats that as success. Often the build itself fails, and the related error messages appear as further findings in the report (e.g. xcodebuild-compiler-error). Build the project once directly in Xcode to see the cause.

Exit 9: installation incomplete​

A resource bundle next to the binary is missing. Install with Scripts/install.sh, which copies the binary and all three bundles together.

Exit 64​

This is not a CodeGuard contract code but a usage error while parsing the arguments, such as an unknown option or --format sarif with version, doctor, config validate or trust.

A run hangs without output​

The most common cause is the keychain after rebuilding CodeGuard in a session without a graphical interface. See Trust and security.

A codeguard-… simulator is left over after a cancelled run​

On SIGTERM or SIGKILL, CodeGuard no longer cleans up. The next run with simulator tests deletes the device, provided a lease exists for it. codeguard doctor shows the number of orphaned devices.

See also​