v1.0.0

You asked for it, so here it is: xcodeinstall no longer uses AWS Secrets Manager. Everything now runs on AWS Systems Manager Parameter Store instead.

Why the change

Secrets Manager charges $0.40 per secret per month. Since xcodeinstall keeps two secrets (your credentials and your session token), that's $0.80/month per region for something that never used any of the features you pay Secrets Manager for: no rotation, no resource policies, just three simple API calls. Parameter Store's standard tier does the exact same job for free, so that's where your secrets live now.

⚠️ This is a breaking change. If you're upgrading from an earlier version, you need to do three things:

1. Update your IAM policy. You only need ssm:PutParameter and ssm:GetParameter now (no more secretsmanager:*, and no kms:* either — values are encrypted with the account's default aws/ssm key automatically).
2. Re-store your secrets. Nothing migrates automatically. Run storesecrets and authenticate again, then delete your old Secrets Manager secrets so they stop costing you money.
3. Rename one flag. --secretmanager-region is now --secret-region. If you were using the short form -s, nothing changes for you.

Full step-by-step instructions are in the README migration section.

One more small thing: your saved region in ~/.xcodeinstall/config.json gets dropped on the first run after upgrading (the key name changed), but it's saved again automatically the next time you pass -s. Your saved profile is untouched.

Cleaner error messages

Fixed an annoying bug where an expired session got reported twice when running download. Error handling now goes through a single presenter, so whatever goes wrong, you'll see it once, with a message that actually matches what happened (instead of a generic "unexpected error" for a few cases that deserved better).

Other changes

• Updated to subprocess 1.0.0
• CI now builds against Xcode 26.6
• Various dependency bumps (swift-argument-parser, swift-log, swift-system)
• Early design doc added for future FIDO2/security-key MFA support (no functionality yet, just groundwork)

Upgrading

Update the IAM policy first, then re-run storesecrets and authenticate. If you're scripting this, remember to swap --secretmanager-region for --secret-region in any long-form flag usage.

What's Changed

• Add multi-version Xcode management by @sebsto in #136
• docs: add FIDO2 / security-key MFA implementation plan (#138) by @sebsto in #139
• Update dependency macos to v26 by @renovate[bot] in #137
• Update dependency apple/swift-log to from: "1.12.1" by @renovate[bot] in #140
• Update dependency apple/swift-argument-parser to from: "1.8.0" by @renovate[bot] in #141
• Update dependency apple/swift-log to from: "1.14.0" by @renovate[bot] in #142
• Update dependency apple/swift-argument-parser to from: "1.8.2" by @renovate[bot] in #143
• Update dependency apple/swift-system to from: "1.7.2" by @renovate[bot] in #144
• Update actions/checkout action to v7 by @renovate[bot] in #145
• Update actions/cache action to v6 by @renovate[bot] in #146
• fix: report each error once, from a single presenter by @sebsto in #155
• Store secrets in SSM Parameter Store instead of Secrets Manager (breaking) by @sebsto in #154

Full Changelog: v0.23.0...v1.0.0