Xcode "resolvePackageDependencies" Fails in CI

xcodebuild ran -resolvePackageDependencies to fetch the Swift Package Manager graph and could not complete it. Usually a package source was unreachable, a private repo needs credentials, or a transient clone failed.

What this error means

xcodebuild -resolvePackageDependencies exits non-zero before any build, reporting it could not clone or resolve one of the package URLs. A network-caused failure often passes on retry; a missing credential or bad URL fails every time.

xcodebuild -resolvePackageDependencies -workspace App.xcworkspace -scheme App
error: failed to resolve dependencies:
  Failed to clone repository https://github.com/your-org/private-kit.git:
  fatal: Authentication failed

Common causes

Transient clone or network failure

A timeout or reset while cloning a package from GitHub leaves the graph unresolved. These blips clear on their own and are unrelated to your manifest.

Private package without credentials

A package hosted on a private repo needs a token or SSH key the runner does not have, so the clone is rejected with an auth error.

How to fix it

Retry, and warm the package cache

For transient failures, retry resolution; cache the resolved packages so most clones are already local.

for i in 1 2 3; do \
  xcodebuild -resolvePackageDependencies -workspace App.xcworkspace -scheme App && break || sleep 15; \
done

Provide credentials for private packages

Inject a token via a git credential helper (or use SSH) so private package URLs resolve.

git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
xcodebuild -resolvePackageDependencies -workspace App.xcworkspace -scheme App

Refresh a stale resolved file

1. If Package.resolved pins a tag that was force-moved or deleted, resolution fails deterministically.
2. Delete *.xcworkspace/xcshareddata/swiftpm/Package.resolved and re-resolve to repin.
3. Commit the regenerated Package.resolved so every runner resolves the same graph.

How to prevent it

• Commit Package.resolved so the package graph is reproducible.
• Cache the SPM clone/derived-data directory keyed on Package.resolved.
• Use a git credential helper or SSH for private package sources.

Related guides