Xcode "resolvePackageDependencies" Fails in CI

By Daniel Zoghalchali·Latchkey

xcodebuild ran -resolvePackageDependencies to fetch the Swift Package Manager graph and could not complete it. Usually a package source was unreachable, a private repo needs credentials, or a transient clone failed.

What this error means

xcodebuild -resolvePackageDependencies exits non-zero before any build, reporting it could not clone or resolve one of the package URLs. A network-caused failure often passes on retry; a missing credential or bad URL fails every time.

xcodebuild output

xcodebuild -resolvePackageDependencies -workspace App.xcworkspace -scheme App
error: failed to resolve dependencies:
  Failed to clone repository https://github.com/your-org/private-kit.git:
  fatal: Authentication failed

Common causes

Transient clone or network failure

A timeout or reset while cloning a package from GitHub leaves the graph unresolved. These blips clear on their own and are unrelated to your manifest.

Private package without credentials

A package hosted on a private repo needs a token or SSH key the runner does not have, so the clone is rejected with an auth error.

How to fix it

Retry, and warm the package cache

For transient failures, retry resolution; cache the resolved packages so most clones are already local.

Terminal

for i in 1 2 3; do \
  xcodebuild -resolvePackageDependencies -workspace App.xcworkspace -scheme App && break || sleep 15; \
done

Provide credentials for private packages

Inject a token via a git credential helper (or use SSH) so private package URLs resolve.

Terminal

git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
xcodebuild -resolvePackageDependencies -workspace App.xcworkspace -scheme App

Refresh a stale resolved file

If Package.resolved pins a tag that was force-moved or deleted, resolution fails deterministically.
Delete *.xcworkspace/xcshareddata/swiftpm/Package.resolved and re-resolve to repin.
Commit the regenerated Package.resolved so every runner resolves the same graph.

How to prevent it

Commit Package.resolved so the package graph is reproducible.
Cache the SPM clone/derived-data directory keyed on Package.resolved.
Use a git credential helper or SSH for private package sources.

Frequently asked questions

What causes ""-resolvePackageDependencies" failed"?