@@ -12,6 +12,8 @@ Run this workflow from the macios repository root.
 Collect or confirm:
 - Target Xcode version (for example `26.4`)
 - Beta number (for example `2`)
+- Azure Artifacts package version (for example `26.4.0-beta.2`)
+- Xcode product build version (for example `17E5212f`)
 - Xcode URL (for example `https://dl.internalx.com/internal-files/xcodes/Xcode_26.4_beta_2.xip`)
 - Optional prior bump PR to mirror
 - Whether to do this in two phases (non-test changes first, tests second)
@@ -26,9 +28,38 @@ Apply minimal, surgical changes in these files:
    - `NUGET_HARDCODED_PRERELEASE_IDENTIFIER=xcode<major.minor>`
    - `NUGET_HARDCODED_PRERELEASE_BRANCH=xcode<major.minor>`
    - `XCODE_VERSION=<major.minor>`
+   - `XCODE_PACKAGE_NAME=xcode-apple-silicon`
+   - `XCODE_PACKAGE_VERSION=<major.minor.patch-beta.number>`
+   - `XCODE_BUILD_VERSION=<ProductBuildVersion>`
    - `XCODE_URL=<user-provided-xip-url>`
    - `XCODE_DEVELOPER_ROOT=/Applications/Xcode_<major.minor>.0-beta<beta>.app/Contents/Developer` (for betas)
 
+   `XCODE_DEVELOPER_ROOT` must name the same application that `XCODE_PACKAGE_VERSION`
+   implies; `install-xcode.sh` refuses to run when the two disagree. The package version is
+   strict SemVer (Azure Artifacts requires it) while the application name follows this
+   repository's convention, so they are deliberately spelled differently:
+
+   | Release | `XCODE_PACKAGE_VERSION` | `XCODE_DEVELOPER_ROOT` application |
+   | --- | --- | --- |
+   | beta 1 | `27.0.0-beta` | `Xcode_27.0.0-beta.app` |
+   | beta 3 | `27.0.0-beta.3` | `Xcode_27.0.0-beta3.app` |
+   | RC 1 | `27.0.0-rc` | `Xcode_27.0.0-rc.app` |
+   | RC 2 | `27.0.0-rc.2` | `Xcode_27.0.0-rc.2.app` |
+   | stable | `27.0.0` | `Xcode_27.0.0.app` |
+   | patch | `27.0.1` | `Xcode_27.0.1.app` (`XCODE_VERSION` stays `27.0`) |
+
+   Betas drop the dot before the ordinal, release candidates keep it, and the first beta or
+   RC carries no ordinal at all. `Xcode_26.3.0-rc2.app` is wrong: it has been written twice
+   and corrected both times. Note that `XCODE_BUILD_VERSION` is what actually distinguishes
+   one beta or RC from the next, so a stale value passes every path check and only fails
+   once the package is installed.
+
+   Before queuing CI, verify that the matching immutable package exists — with its
+   Apple-signed XIP and `xcode-metadata.json` — in **both** feeds, because the two
+   pipelines resolve the same coordinates in their own organization:
+   - `devdiv/DevDiv/macios-tools-internal`
+   - `dnceng/internal/macios-tools-internal`
+
 2. `Make.versions`
    - Bump:
      - `IOS_NUGET_OS_VERSION`
 
@@ -21,11 +21,11 @@ Download updated expected app size files from Azure DevOps artifacts for the cur
 
 The app size tests (`tests/dotnet/UnitTests/AppSizeTest.cs`) compare the built app's size and preserved APIs against expected files stored in `tests/dotnet/UnitTests/expected/`. When the test detects a difference and `WRITE_KNOWN_FAILURES` is not set, it writes the updated expected file to `$(Build.ArtifactStagingDirectory)/updated-expected-sizes/`, and a pipeline step publishes this directory as a build artifact.
 
-The artifact name follows the pattern `{uploadPrefix}updated-expected-sizes-{testPrefix}-{attempt}` (e.g., `updated-expected-sizes-dotnettests_ios-1`). Inside the artifact, files are named after the test variant:
-- `{Platform}-{Variant}-size.txt` — e.g., `iOS-MonoVM-size.txt`, `iOS-MonoVM-interpreter-size.txt`, `iOS-NativeAOT-TrimmableStatic-size.txt`, `MacOSX-CoreCLR-Interpreter-size.txt`
-- `{Platform}-{Variant}-preservedapis.txt` — e.g., `iOS-MonoVM-preservedapis.txt`, `MacCatalyst-MonoVM-interpreter-preservedapis.txt`
+The artifact name follows the pattern `{uploadPrefix}updated-expected-sizes-{testPrefix}-{attempt}` (e.g., `updated-expected-sizes-dotnettests_ios-1`). Because the expected files can be very big, the test uploads a unified **diff** for each changed expected file rather than the whole file. Inside the artifact, files are named after the test variant with a `.diff` suffix:
+- `{Platform}-{Variant}-size.txt.diff` — e.g., `iOS-MonoVM-size.txt.diff`, `iOS-MonoVM-interpreter-size.txt.diff`, `iOS-NativeAOT-TrimmableStatic-size.txt.diff`, `MacOSX-CoreCLR-Interpreter-size.txt.diff`
+- `{Platform}-{Variant}-preservedapis.txt.diff` — e.g., `iOS-MonoVM-preservedapis.txt.diff`, `MacCatalyst-MonoVM-interpreter-preservedapis.txt.diff`
 
-The expected files on disk are at:
+Each diff is a unified diff (relative to the repository root) that can be applied with `git apply -p1` or `patch -p1`. The expected files on disk are at:
 - `tests/dotnet/UnitTests/expected/{Platform}-{Variant}-size.txt`
 - `tests/dotnet/UnitTests/expected/{Platform}-{Variant}-preservedapis.txt`
 
@@ -85,15 +85,17 @@ If `az` is not available or not authenticated, direct the user to download manua
 
 ### 4. Place the files
 
-Extract the downloaded artifact zip and place the files in the expected directory:
+Extract the downloaded artifact zip and apply each diff to the expected directory from the repository root:
 
 ```bash
-EXPECTED_DIR="tests/dotnet/UnitTests/expected"
 unzip -o artifact.zip -d /tmp/updated-sizes/
-cp /tmp/updated-sizes/*/*.txt "$EXPECTED_DIR/"
+# Each '*.txt.diff' is a unified diff relative to the repository root.
+for diff in /tmp/updated-sizes/*/*.txt.diff; do
+  git apply -p1 "$diff"
+done
 ```
 
-The files inside the zip already have the correct names (e.g., `iOS-MonoVM-size.txt`) and can be copied directly.
+The diffs reference `tests/dotnet/UnitTests/expected/<name>.txt` directly, so applying them updates (or creates) the expected files in place. If a diff fails to apply cleanly (e.g., the expected file changed since the CI build), re-run the failing app size test locally with `WRITE_KNOWN_FAILURES=1` to regenerate the file (see the "Run Locally" fallback).
 
 ### 5. Verify and commit
 
@@ -112,7 +114,7 @@ If automated download fails (auth issues, etc.), provide the user with:
 1. The Azure DevOps build URL
 2. Instructions to navigate to the build → Summary → Artifacts section
 3. Look for individual artifacts whose names contain `updated-expected-sizes`
-4. Download the artifact zip, extract it, and copy the `.txt` files (e.g., `iOS-MonoVM-interpreter-size.txt`) into `tests/dotnet/UnitTests/expected/`
+4. Download the artifact zip, extract it, and apply the `.txt.diff` files (e.g., `iOS-MonoVM-interpreter-size.txt.diff`) from the repository root with `git apply -p1 <file>`
 
 ## Fallback: Run Locally
 
 
@@ -158,7 +158,7 @@ jobs:
       operation: ${{ steps.record.outputs.operation }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -249,7 +249,7 @@ jobs:
       run_url: ${{ steps.record.outputs.run_url }}
     steps:
       - name: Checkout actions folder
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             actions
@@ -297,7 +297,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -343,7 +343,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -448,7 +448,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -577,7 +577,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
 
@@ -130,50 +130,93 @@ jobs:
           core.setOutput('repo_full_name', pr.head.repo.full_name);
 
     - name: Checkout PR branch
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ steps.pr-branch.outputs.ref }}
         repository: ${{ steps.pr-branch.outputs.repo_full_name }}
         token: ${{ secrets.GITHUB_TOKEN }}
         persist-credentials: true
 
-    - name: Download and apply gist files
+    - name: Download and apply gist diffs
       env:
         GIST_ID: ${{ steps.parse.outputs.gist_id }}
       run: |
         EXPECTED_DIR="tests/dotnet/UnitTests/expected"
         mkdir -p "$EXPECTED_DIR"
-        export EXPECTED_DIR
 
-        # Download gist metadata to get file URLs. The Gists API isn't accessible to the
-        # GitHub Actions token (a GitHub App installation token), so fetch it unauthenticated.
+        DIFF_DIR="$(mktemp -d)"
+        export DIFF_DIR EXPECTED_DIR
+
+        # Download gist metadata to get file URLs. The Gists API isn't accessible to the GitHub Actions token
+        # (a GitHub App installation token), so fetch it unauthenticated.
         if ! GIST_JSON=$(curl -fSL -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" -H "User-Agent: dotnet-macios-apply-gist" "https://api.github.com/gists/$GIST_ID"); then
             echo "Failed to fetch gist '$GIST_ID' (404/403/rate limit?)." >&2
             exit 1
         fi
+
+        # Newer builds upload a unified diff ('<name>.txt.diff') for each changed expected file, instead of the
+        # entire (potentially very large) expected file. For backwards compatibility we still accept gists that
+        # contain the full expected files ('<name>.txt'). Download and validate everything, applying diffs and
+        # writing full files below.
         echo "$GIST_JSON" | python3 -c "
         import json, sys, urllib.request, os, re
 
         gist = json.load(sys.stdin)
+        diff_dir = os.environ['DIFF_DIR']
         expected_dir = os.environ['EXPECTED_DIR']
         files = gist['files']
-        # Only allow known expected-file patterns
-        allowed_pattern = re.compile(r'^[A-Za-z0-9]+-[A-Za-z0-9-]+-(size|preservedapis)\.txt$')
+        # Allowed expected-file name, and the same name with a '.diff' suffix (a unified diff of that file).
+        allowed_diff = re.compile(r'^[A-Za-z0-9]+-[A-Za-z0-9-]+-(size|preservedapis)\.txt\.diff$')
+        allowed_full = re.compile(r'^[A-Za-z0-9]+-[A-Za-z0-9-]+-(size|preservedapis)\.txt$')
+        applied = 0
         for filename, file_info in files.items():
-            if not allowed_pattern.match(filename):
+            is_diff = bool(allowed_diff.match(filename))
+            is_full = bool(allowed_full.match(filename))
+            if not is_diff and not is_full:
                 print(f'Skipping file with unexpected name: {filename}')
                 continue
             content = file_info.get('content')
             if content is None:
                 # Large files need to be fetched from raw_url
                 raw_url = file_info['raw_url']
                 content = urllib.request.urlopen(raw_url).read().decode('utf-8')
-            dest = os.path.join(expected_dir, filename)
-            with open(dest, 'w') as f:
-                f.write(content)
-            print(f'Applied: {filename}')
+            # Gist content can be served with CRLF line endings; normalize to LF
+            # so 'git apply' doesn't fail against the repo's LF expected files.
+            content = content.replace('\r\n', '\n').replace('\r', '\n')
+            if is_diff:
+                # The diff for '<name>.txt.diff' is only allowed to touch 'tests/dotnet/UnitTests/expected/<name>.txt'.
+                expected_target = 'tests/dotnet/UnitTests/expected/' + filename[:-len('.diff')]
+                allowed_targets = ('/dev/null', 'a/' + expected_target, 'b/' + expected_target)
+                for line in content.splitlines():
+                    if line.startswith('--- ') or line.startswith('+++ '):
+                        # Strip a trailing tab + timestamp if present, then verify the target path.
+                        target = line[4:].split('\t', 1)[0].strip()
+                        if target not in allowed_targets:
+                            print(f'Rejecting diff {filename}: unexpected target path: {target}')
+                            sys.exit(1)
+                dest = os.path.join(diff_dir, filename)
+                with open(dest, 'w') as f:
+                    f.write(content)
+                print(f'Downloaded diff: {filename}')
+            else:
+                # Full expected file: write it directly into the expected directory.
+                dest = os.path.join(expected_dir, filename)
+                with open(dest, 'w') as f:
+                    f.write(content)
+                print(f'Applied full file: {filename}')
+            applied += 1
+        if applied == 0:
+            print('No applicable files found in gist.')
+            sys.exit(1)
         "
 
+        # Apply each diff. 'git apply' handles both modifications of existing files and creation of new files.
+        shopt -s nullglob
+        for diff in "$DIFF_DIR"/*.diff; do
+          echo "Applying $(basename "$diff")..."
+          git apply -p1 --verbose "$diff"
+        done
+
     - name: Commit and push
       env:
         GIST_URL: ${{ steps.parse.outputs.gist_url }}
 
@@ -14,7 +14,7 @@ jobs:
 
     steps:
     - name: 'Checkout'
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ github.head_ref }}
         fetch-depth: 1
@@ -59,7 +59,7 @@ jobs:
 
     steps:
     - name: 'Checkout'
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: ${{ github.event.pull_request.head.repo.full_name }}
         ref: ${{ github.event.pull_request.head.sha }}
 
@@ -21,7 +21,7 @@ jobs:
         contains(github.event.pull_request.title, 'Update dependencies from dotnet/')
     steps:
     - name: 'Checkout repo'
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
         repository: ${{ github.event.pull_request.head.repo.full_name }}
 
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install gh-aw extension