Sandboxing is failing build unexpectedly on Github Actions

Hi @braker1nine! I’m Dosu and I’m helping the tuist team.

This issue happens because Tuist’s sandbox profile allows read access to the selected Xcode app directory, but that isn’t always enough for Xcode’s internal libraries like libxcrun.dylib—especially on CI runners where Xcode installs may be symlinked or have different permissions. When you switch Xcode versions with xcode-select, Tuist dynamically updates the sandbox to include the new Xcode path, but if the sandbox doesn’t explicitly allow access to all required subpaths, you can hit errors like “file system sandbox blocked open()” for dylibs inside the Xcode bundle (source).

Workarounds:

• The quickest fix is to disable sandboxing in your manifest using disableSandbox in Tuist.GenerationOptions, but this is discouraged because it can slow down generation and break manifest caching (docs, issue).
• The preferred approach is to avoid file system operations in your manifests and use environment variables for configuration data instead (issue).
• If you must select a non-default Xcode, try to ensure the runner’s Xcode install isn’t symlinked and has standard permissions, or stick to the default Xcode version provided by the runner image.

No recent Tuist changes address this directly, so if you need broader access, disabling the sandbox is the only immediate workaround.

To reply, just mention @dosu.

Share context across your team and agents. Try Dosu.

@dosu

We’re seeing a similar issue in our CI environment but we can’t produce it locally. The full output from tuist generate is below, but perhaps the most telling line is error: cannot open file '/Users/vagrant/.local/share/mise/installs/tuist/4.74.1/bin/ProjectDescription.framework/Modules/module.modulemap': Operation not permitted

If we disable the sandbox in our manifest, everything works as expected.

Loading and constructing the graph
It might take a while if the cache is empty
✖ Error 
  The command `sandbox-exec -p '(version 1) 
  ; Deny all operations by default unless explicitly allowed 
  (deny default) 
  ; Import base system rules 
  (import "[system.sb](https://system.sb/)") 
  ; Allow process operations (fork, exec, etc.) 
  (allow process*) 
  ; Allow querying information about the current process 
  (allow process-info* (target self)) 
  ; Allow reading file metadata (permissions, size, etc.) 
  (allow file-read-metadata) 
  ; Allow reading and writing temporary and intermediate build files and caches 
  (allow file-read* file-write* (subpath "/private/tmp/")) 
  (allow file-read* file-write* (subpath "/private/var/")) 
  ; Allow reading from specified paths 
  (allow file-read* (subpath "/Applications/[Xcode-26.0.0.app](https://xcode-26.0.0.app/)")) 
  (allow file-read* (subpath "/Users/vagrant/git/Workspace.swift")) 
  (allow file-read* (subpath "/Users/vagrant/.local/share/mise/installs/tuist/4.74.1/bin")) 
  (allow file-read* (subpath "/Library/Preferences/[com.apple](https://com.apple/).dt.Xcode.plist")) 
  (allow file-read* (subpath "/Users/vagrant/.cache/tuist/ProjectDescriptionHelpers/afcae3bff2bd317a327834f5d0c74361"))' /usr/bin/xcrun swift -suppress-warnings -I /Users/vagrant/.local/share/mise/installs/tuist/4.74.1/bin -L /Users/vagrant/.local/share/mise/installs/tuist/4.74.1/bin -F /Users/vagrant/.local/share/mise/installs/tuist/4.74.1/bin -lProjectDescription -framework ProjectDescription -I /Users/vagrant/.cache/tuist/ProjectDescriptionHelpers/afcae3bff2bd317a327834f5d0c74361 -L /Users/vagrant/.cache/tuist/ProjectDescriptionHelpers/afcae3bff2bd317a327834f5d0c74361 -F /Users/vagrant/.cache/tuist/ProjectDescriptionHelpers/afcae3bff2bd317a327834f5d0c74361 -lProjectDescriptionHelpers /Users/vagrant/git/Workspace.swift --tuist-dump` exited with error code 1 and message: 
  <unknown>:0: error: cannot open file '/Users/vagrant/.local/share/mise/installs/tuist/4.74.1/bin/ProjectDescription.framework/Modules/module.modulemap': Operation not permitted 
  /Users/vagrant/git/Workspace.swift:1:8: error: no such module 'ProjectDescription' 
   1 | import ProjectDescription 
     |        `- error: no such module 'ProjectDescription' 
   2 | import ProjectDescriptionHelpers 
   3 |  

  Sorry this didn’t work. Here’s what to try next: 
   ▸ If the error is actionable, address it
   ▸ If the error is not actionable, let's discuss it in the <Troubleshooting & how to: https://community.tuist.dev/c/troubleshooting-how-to/6>
   ▸ If you are very certain it's a bug, <file an issue: https://github.com/tuist/tuist>
   ▸ Check out the logs at /Users/vagrant/.local/state/tuist/logs/C6B6D862-3BE9-4534-9CCA-9E0E0197135E.log
Tuist project generation failed

Hey folks 👋

disableSandbox is the best workaround for now, although it should not be needed. @hiltonc any ideas why this is happening?

I would not expect to see this:

'/Applications/Xcode_26.0.0.app/Contents/Developer/usr/lib/libxcrun.dylib' (file system sandbox blocked open())

with this in the sandbox profile:

(allow file-read* (subpath "/Applications/Xcode_26.0.0.app"))

or this:

cannot open file '/Users/vagrant/.local/share/mise/installs/tuist/4.74.1/bin/ProjectDescription.framework/Modules/module.modulemap': Operation not permitted

with this in the sandbox profile:

(allow file-read* (subpath "/Users/vagrant/.local/share/mise/installs/tuist/4.74.1/bin")) 

I’m not an expert on sandbox profiles, there may be a straightforward setting that we need that I’m not aware of.

If we wanted sandbox to be opt out, we could automatically disable it for CI, since we’d probably get most of the benefit locally anyway.