Shopify · wcandillon · Jun 19, 2026 · Jun 19, 2026
diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
@@ -5,10 +5,6 @@ inputs:
   github_token:
     description: 'GitHub Token'
     required: false
-  download_skia:
-    description: 'Download Skia Binary Artifacts'
-    required: false
-    default: 'true'
   graphite:
     description: 'Use Graphite Skia Build'
     required: false
@@ -32,13 +28,11 @@ runs:
     - name: Install dependencies
       run: yarn install --immutable
       shell: bash
-      env:
-        SKIP_SKIA_DOWNLOAD: ${{ inputs.download_skia == 'false' && '1' || '' }}
 
-    - name: Copy Skia headers (standard build)
+    - name: Install Skia (standard build)
       if: inputs.graphite != 'true'
       working-directory: packages/skia
-      run: yarn copy-skia-headers
+      run: yarn install-skia
       shell: bash
 
     - name: Install Skia Graphite

diff --git a/.github/workflows/build-dawn.yml b/.github/workflows/build-dawn.yml
@@ -7,7 +7,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  DAWN_BRANCH: chromium/7770  # Configure the Dawn branch to checkout
+  DAWN_BRANCH: chromium/7849  # Configure the Dawn branch to checkout
 
 jobs:
   prepare-release:
@@ -19,7 +19,7 @@ jobs:
       release_name: ${{ steps.release_meta.outputs.release_name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
 
       - name: Determine Dawn branch metadata
         id: dawn_meta
@@ -45,7 +45,7 @@ jobs:
 
       - name: Create GitHub release
         id: create_release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -92,15 +92,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout main repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
 
       - name: Checkout Dawn repository
         run: |
           git clone --depth 1 --branch ${{ env.DAWN_BRANCH }} https://dawn.googlesource.com/dawn externals/dawn
 
       - name: Setup Android NDK
         id: setup-ndk
-        uses: nttld/setup-ndk@v1
+        uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1.6.0
         with:
           ndk-version: r27d
 
@@ -117,6 +117,7 @@ jobs:
             -DCMAKE_BUILD_TYPE=Release \
             -DBUILD_SHARED_LIBS=OFF \
             -DDAWN_BUILD_MONOLITHIC_LIBRARY=SHARED \
+            -DDAWN_BUILD_PROTOBUF=OFF \
             -DANDROID_SUPPORT_FLEXIBLE_PAGE_SIZES=ON \
             -DCMAKE_EXE_LINKER_FLAGS="-llog" \
             -DCMAKE_SHARED_LINKER_FLAGS="-llog -Wl,-z,max-page-size=16384"
@@ -175,15 +176,15 @@ jobs:
     runs-on: macos-latest-large
     steps:
       - name: Checkout main repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
 
       - name: Checkout Dawn repository
         run: |
           git clone --depth 1 --branch ${{ env.DAWN_BRANCH }} https://dawn.googlesource.com/dawn externals/dawn
 #          submodules: true
 
       - name: Setup Xcode
-        uses: maxim-lobanov/setup-xcode@v1
+        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90 # v1.7.0
         with:
           xcode-version: latest-stable
 
@@ -200,7 +201,8 @@ jobs:
             -C externals/dawn/.github/workflows/dawn-ci.cmake \
             -DCMAKE_TOOLCHAIN_FILE=build-tools/apple.toolchain.cmake \
             ${{ matrix.cmake_args }} \
-            -DCMAKE_BUILD_TYPE=Release
+            -DCMAKE_BUILD_TYPE=Release \
+            -DDAWN_BUILD_PROTOBUF=OFF
           ninja -C ${{ matrix.output_dir }}
       - name: Upload build artifacts
         uses: actions/upload-artifact@v7
@@ -214,7 +216,7 @@ jobs:
     needs: [prepare-release, mobile-android, mobile-apple]
     steps:
       - name: Checkout main repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@v6.0.3
 
       - name: Download all build artifacts
         uses: actions/download-artifact@v8
@@ -263,7 +265,7 @@ jobs:
           tar -czf dawn-headers-${TAG}.tar.gz dawn-headers
 
       - name: Upload to GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

diff --git a/.github/workflows/build-npm.yml b/.github/workflows/build-npm.yml
@@ -15,7 +15,7 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: checkout
-        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5.0.0
         with:
           submodules: recursive
 
@@ -38,7 +38,7 @@ jobs:
           NPM_CONFIG_PROVENANCE: true
 
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./apps/docs/build

diff --git a/.github/workflows/build-skia-graphite.yml b/.github/workflows/build-skia-graphite.yml
@@ -15,11 +15,6 @@ on:
         required: false
         type: boolean
         default: false
-      skip_skia_download:
-        description: 'Skip downloading prebuilt Skia (always true for building from source)'
-        required: false
-        type: boolean
-        default: true
 jobs:
   prepare-release:
     runs-on: ubuntu-latest
@@ -30,7 +25,7 @@ jobs:
       release_name: ${{ steps.release_meta.outputs.release_name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5.0.0
         with:
           submodules: recursive
           fetch-depth: 0
@@ -85,7 +80,7 @@ jobs:
       - name: Create GitHub release
         if: ${{ github.event.inputs.dry_run != 'true' }}
         id: create_release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -124,7 +119,7 @@ jobs:
       fail-fast: false
     steps:
       - name: checkout
-        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5.0.0
         with:
           submodules: recursive
 
@@ -140,7 +135,7 @@ jobs:
       - name: Setup Android NDK
         id: setup-ndk
         if: startsWith(matrix.target, 'android')
-        uses: nttld/setup-ndk@afb4c9964b521afb97c864b7d40b11e6911bd410 # v1.5.0
+        uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1.6.0
         with:
           ndk-version: r27d
 
@@ -149,12 +144,11 @@ jobs:
         run: echo "ANDROID_NDK=$ANDROID_HOME/ndk-bundle" >> $GITHUB_ENV
 
       - name: Setup Ninja
-        uses: seanmiddleditch/gha-setup-ninja@master
+        uses: seanmiddleditch/gha-setup-ninja@7e868db0f3406270dd46e1dac26c65f621456723 # master
 
       - name: Setup
         uses: ./.github/actions/setup
         with:
-          download_skia: ${{ github.event.inputs.skip_skia_download == 'true' && 'false' || 'true' }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Update depot_tools
@@ -213,7 +207,7 @@ jobs:
 
       - name: Upload binaries to GitHub release - ${{ matrix.artifact_name }}
         if: ${{ github.event.inputs.dry_run != 'true' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -258,7 +252,7 @@ jobs:
 
       - name: Upload Graphite Headers to GitHub release
         if: ${{ matrix.target == 'apple-ios' && github.event.inputs.dry_run != 'true' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

diff --git a/.github/workflows/build-skia.yml b/.github/workflows/build-skia.yml
@@ -11,11 +11,6 @@ on:
         required: false
         type: boolean
         default: false
-      skip_skia_download:
-        description: 'Skip downloading prebuilt Skia (always true for building from source)'
-        required: false
-        type: boolean
-        default: true
 jobs:
   prepare-release:
     runs-on: ubuntu-latest
@@ -26,7 +21,7 @@ jobs:
       release_name: ${{ steps.release_meta.outputs.release_name }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5.0.0
         with:
           submodules: recursive
           fetch-depth: 0
@@ -63,7 +58,7 @@ jobs:
       - name: Create GitHub release
         if: ${{ github.event.inputs.dry_run != 'true' }}
         id: create_release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -103,24 +98,23 @@ jobs:
       fail-fast: false
     steps:
       - name: checkout
-        uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v5.0.0
         with:
           submodules: recursive
 
       - name: Setup Android NDK
         id: setup-ndk
         if: startsWith(matrix.target, 'android')
-        uses: nttld/setup-ndk@afb4c9964b521afb97c864b7d40b11e6911bd410 # v1.5.0
+        uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1.6.0
         with:
           ndk-version: r27c
 
       - name: Setup Ninja
-        uses: seanmiddleditch/gha-setup-ninja@master
+        uses: seanmiddleditch/gha-setup-ninja@7e868db0f3406270dd46e1dac26c65f621456723 # master
 
       - name: Setup
         uses: ./.github/actions/setup
         with:
-          download_skia: ${{ github.event.inputs.skip_skia_download == 'true' && 'false' || 'true' }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Update depot_tools
@@ -164,7 +158,7 @@ jobs:
 
       - name: Upload binaries to GitHub release - ${{ matrix.artifact_name }}
         if: ${{ github.event.inputs.dry_run != 'true' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: