Add daily API docs update workflow by mattleibow · Pull Request #63 · mono/SkiaSharp-API-docs

mattleibow · 2026-02-27T09:19:06Z

Summary

Full self-contained workflow that generates XML API docs from SkiaSharp CI NuGet packages.

How it works

Checks out mono/SkiaSharp at a configurable branch (default: main) — no submodules, just the Cake scripts
Checks out this docs repo into the docs/ directory
Installs GTK# 2 MSI (required by mdoc.exe for SkiaSharp.Views.Gtk)
Downloads latest NuGet packages from the public CI feed
Runs dotnet cake --target=update-docs
If changes detected, creates a PR

Parameters

skiasharp-branch: SkiaSharp branch to check out for Cake scripts + version info (default: main)

Schedule

Daily at 6 AM UTC + manual workflow_dispatch

Why in this repo?

GITHUB_TOKEN has native write access to its own repo — no PATs, deploy keys, or GitHub Apps needed.

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-02-27T09:21:06Z

Learn Build status updates of commit 8cca112:

✅ Validation status: passed

File	Status	Preview URL	Details
.github/workflows/update-docs.yml	✅Succeeded

For more details, please refer to the build report.

The workflow now lives in the docs repo (mono/SkiaSharp-API-docs#63) where GITHUB_TOKEN has native write access, eliminating the need for cross-repo PATs or deploy keys. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

learn-build-service-prod · 2026-02-27T09:26:49Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-02-27T09:27:32Z

Learn Build status updates of commit 96d714b:

✅ Validation status: passed

File	Status	Preview URL	Details
.github/workflows/update-docs.yml	✅Succeeded

For more details, please refer to the build report.

Full workflow that checks out mono/SkiaSharp at a configurable branch, installs GTK# 2 MSI, and runs Cake doc generation targets. Supports a skiasharp-branch parameter to generate docs from any SkiaSharp branch. Schedule: daily at 6 AM UTC, plus manual workflow_dispatch. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

learn-build-service-prod · 2026-02-27T09:59:47Z

PoliCheck Scan Report

The following report lists PoliCheck issues in PR files. Before you merge the PR, you must fix all severity-1 and severity-2 issues. The AI Review Details column lists suggestions for either removing or replacing the terms. If you find a false positive result, mention it in a PR comment and include this text: #policheck-false-positive. This feedback helps reduce false positives in future scans.

✅ No issues found

More information about PoliCheck

Information: PoliCheck | Severity Guidance | Term
For any questions: Try searching the learn.microsoft.com contributor guides or post your question in the Learn support channel.

learn-build-service-prod · 2026-02-27T10:00:23Z

Learn Build status updates of commit c3045cf:

✅ Validation status: passed

File	Status	Preview URL	Details
.github/workflows/update-docs.yml	✅Succeeded

For more details, please refer to the build report.

Copilot

Pull request overview

This PR adds a new GitHub Actions workflow that automates the daily update of API documentation for SkiaSharp. The workflow checks out the SkiaSharp repository to access Cake build scripts, downloads the latest CI NuGet packages, generates XML API documentation, and automatically creates a pull request with any documentation changes.

Changes:

Adds a new workflow file that runs daily at 6 AM UTC and can be manually triggered
Checks out both the mono/SkiaSharp repository (for Cake scripts) and the docs repository
Installs GTK# 2 as a dependency, downloads NuGet packages, and regenerates API docs using Cake tasks
Automatically creates or updates a PR if documentation changes are detected

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-27T10:24:34Z

+        run: |
+          cd docs
+          git add -A
+          git diff --cached --quiet
+          if ($LASTEXITCODE -eq 0) {
+            Write-Host "No documentation changes detected"
+            exit 0
+          }


In GitHub Actions PowerShell steps, $ErrorActionPreference is set to 'Stop' by default, which means git diff --cached --quiet will throw an error when it exits with code 1 (indicating changes exist). This will cause the step to fail before $LASTEXITCODE can be checked. Add $ErrorActionPreference = 'Continue' at the start of the script block, or check the exit code explicitly with a command like git diff --cached --quiet; $hasChanges = $LASTEXITCODE -ne 0.

Copilot · 2026-02-27T10:24:34Z

+          $msiUrl = "https://github.com/mono/gtk-sharp/releases/download/2.12.45/gtk-sharp-2.12.45.msi"
+          $msiPath = "$env:RUNNER_TEMP\gtk-sharp.msi"
+          Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath
+          Start-Process msiexec.exe -ArgumentList "/i", $msiPath, "/quiet", "/norestart" -Wait -NoNewWindow


The GTK# installation step does not verify whether the MSI installation completed successfully. Consider checking the exit code of the msiexec process and failing the workflow if the installation fails, as this is a required dependency for the docs generation. You can add -PassThru to Start-Process and check its ExitCode property.

Suggested change

Start-Process msiexec.exe -ArgumentList "/i", $msiPath, "/quiet", "/norestart" -Wait -NoNewWindow

$process = Start-Process msiexec.exe -ArgumentList "/i", $msiPath, "/quiet", "/norestart" -Wait -NoNewWindow -PassThru

if ($process.ExitCode -ne 0) {

Write-Error "GTK# installation failed with exit code $($process.ExitCode)."

exit $process.ExitCode

}

Copilot · 2026-02-27T10:24:35Z

+          git commit -m "Update API docs from latest CI build"
+          git push origin automation/update-api-docs --force
+          # Create PR if one doesn't already exist
+          $existing = gh pr list --head automation/update-api-docs --state open --json number --jq '.[0].number'


The gh pr list command with --jq '.[0].number' will return an empty string if no PRs exist, but if the command itself fails (e.g., network issues, auth problems), it may also return empty or cause an error. Consider adding explicit error handling for the gh commands to distinguish between "no PR exists" and "command failed". For example, check $LASTEXITCODE after the gh pr list command.

Suggested change

$existing = gh pr list --head automation/update-api-docs --state open --json number --jq '.[0].number'

$existing = gh pr list --head automation/update-api-docs --state open --json number --jq '.[0].number'

if ($LASTEXITCODE -ne 0) {

Write-Error "Failed to list existing pull requests. 'gh pr list' exited with code $LASTEXITCODE."

exit $LASTEXITCODE

}

Copilot · 2026-02-27T10:24:35Z

+          $msiPath = "$env:RUNNER_TEMP\gtk-sharp.msi"
+          Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath


The workflow downloads and installs the GTK# MSI without verifying its integrity using a checksum. While the source is trusted (mono/gtk-sharp), consider adding a SHA256 checksum verification after downloading the MSI to ensure it hasn't been tampered with. This follows security best practices for downloading and executing external binaries.

Suggested change

$msiPath = "$env:RUNNER_TEMP\gtk-sharp.msi"

Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath

$msiPath = "$env:RUNNER_TEMP\gtk-sharp.msi"

$expectedHash = "<REPLACE_WITH_ACTUAL_SHA256_OF_gtk-sharp-2.12.45.msi>"

Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath

$actualHash = (Get-FileHash -Path $msiPath -Algorithm SHA256).Hash.ToLowerInvariant()

if ($actualHash -ne $expectedHash.ToLowerInvariant()) {

Write-Error "GTK# MSI SHA256 mismatch. Expected: $expectedHash, Actual: $actualHash"

throw "Downloaded GTK# MSI failed integrity check."

}

Copilot · 2026-02-27T10:24:35Z

+      - name: Download latest NuGet packages
+        run: dotnet cake --target=docs-download-output
+
+      - name: Regenerate API docs
+        run: dotnet cake --target=update-docs


The Cake commands on lines 52 and 55 are executed from the SkiaSharp repository root, but it's not clear whether these Cake tasks expect the docs repository to be in the docs/ subdirectory. If the Cake scripts have hardcoded paths or different expectations, these commands might fail. Consider adding a comment documenting this assumption or verifying that the Cake tasks are configured to use the docs/ path.

mattleibow mentioned this pull request Feb 27, 2026

Fix case-sensitive nupkg path + move docs workflow to docs repo mono/SkiaSharp#3532

Merged

mattleibow force-pushed the automation/add-update-workflow branch from 8cca112 to 96d714b Compare February 27, 2026 09:25

mattleibow force-pushed the automation/add-update-workflow branch from 96d714b to c3045cf Compare February 27, 2026 09:58

mattleibow requested a review from Copilot February 27, 2026 10:20

Copilot started reviewing on behalf of mattleibow February 27, 2026 10:21 View session

mattleibow merged commit 5c06f29 into main Feb 27, 2026
5 checks passed

mattleibow deleted the automation/add-update-workflow branch February 27, 2026 10:21

Copilot AI reviewed Feb 27, 2026

View reviewed changes

-          Start-Process msiexec.exe -ArgumentList "/i", $msiPath, "/quiet", "/norestart" -Wait -NoNewWindow
+          $process = Start-Process msiexec.exe -ArgumentList "/i", $msiPath, "/quiet", "/norestart" -Wait -NoNewWindow -PassThru
+          if ($process.ExitCode -ne 0) {
+            Write-Error "GTK# installation failed with exit code $($process.ExitCode)."
+            exit $process.ExitCode
+          }

-          $existing = gh pr list --head automation/update-api-docs --state open --json number --jq '.[0].number'
+          $existing = gh pr list --head automation/update-api-docs --state open --json number --jq '.[0].number'
+          if ($LASTEXITCODE -ne 0) {
+            Write-Error "Failed to list existing pull requests. 'gh pr list' exited with code $LASTEXITCODE."
+            exit $LASTEXITCODE
+          }

		$msiPath = "$env:RUNNER_TEMP\gtk-sharp.msi"
		Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath

-          $msiPath = "$env:RUNNER_TEMP\gtk-sharp.msi"
-          Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath
+          $msiPath = "$env:RUNNER_TEMP\gtk-sharp.msi"
+          $expectedHash = "<REPLACE_WITH_ACTUAL_SHA256_OF_gtk-sharp-2.12.45.msi>"
+          Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath
+          $actualHash = (Get-FileHash -Path $msiPath -Algorithm SHA256).Hash.ToLowerInvariant()
+          if ($actualHash -ne $expectedHash.ToLowerInvariant()) {
+            Write-Error "GTK# MSI SHA256 mismatch. Expected: $expectedHash, Actual: $actualHash"
+            throw "Downloaded GTK# MSI failed integrity check."
+          }

Uh oh!

Conversation

mattleibow commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

How it works

Parameters

Schedule

Why in this repo?

Related

Uh oh!

learn-build-service-prod Bot commented Feb 27, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod Bot commented Feb 27, 2026

✅ Validation status: passed

Uh oh!

learn-build-service-prod Bot commented Feb 27, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod Bot commented Feb 27, 2026

✅ Validation status: passed

Uh oh!

learn-build-service-prod Bot commented Feb 27, 2026

PoliCheck Scan Report

✅ No issues found

More information about PoliCheck

Uh oh!

learn-build-service-prod Bot commented Feb 27, 2026

✅ Validation status: passed

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mattleibow commented Feb 27, 2026 •

edited

Loading