Adoption at a glance
Loading NuGet download figures…
Automation & AI
AI in SkiaSharp
SkiaSharp is a large native binding that tracks Google's Skia engine along Chrome's release train. A small team keeps it current because agentic workflows handle the repetitive work and deterministic scripts handle the mechanics. Humans spend their time on API design and correctness.
AI does not write the graphics engine. It does the toil: syncing upstream, diffing APIs, scaffolding docs, triaging issues, and auditing for CVEs. The mechanical steps run as plain scripts, the agent does the judgement work, and every code or documentation change is proposed through a normal, reviewable pull request.
7
agentic workflows across two repositories
23
reusable skills the workflows and maintainers share
4×
daily upstream Skia sync passes
100%
code and docs changes proposed as reviewable PRs
Moving faster with AI
The dashboard
A few signals the automation moves, cached when the site rebuilds and refreshed from public data. Every number below links back to its source, and each panel notes the date it was last refreshed so a stale figure is obvious rather than hidden.
Time to keep up with upstream
AI opens, tests, and lands the sync PR; humans review the API.
Loading milestone cadence…
What the automation costs
Loading weekly cost…
How it fits together
The loop
The Skia update lifecycle runs in two phases. First the upstream sync lands in the library. Then, once a release is on main, two independent flows publish in parallel: one writes the website release notes, the other writes the API reference. Automation does the mechanical work, the AI agent does the parts that need judgement, and a maintainer reviews before anything ships.
- AI agent
- Automation
- Human review
Phase 1 · Sync to merge
Engine & bindings → nuget.org
Step 1
Sync upstream
Merge new commits from Google's Skia, resolve conflicts, and regenerate the bindings.
AI agent
Step 2
Build & test
Build the native and managed libraries and run the full test suite on the pull requests.
Automation
Step 3
Review & merge
A maintainer reviews the two pull requests and merges them into main.
Human reviewPhase 2 · Publish, in parallel
Release notes & API diffs → website
Diff the packages
Compute the public API diff across every published NuGet of both families.
AutomationPolish the notes
Turn the raw diffs and data into readable, human release notes.
AI agentReview & merge
A maintainer merges the docs PR and the website rebuilds.
Human reviewAPI docs → Microsoft Learn
Regenerate stubs
Rebuild the XML reference stubs from the latest published packages.
AutomationFill & review
Fill the missing entries and review the existing reference docs.
AI agentValidate & publish
The Microsoft Learn build gates the PR; it auto-merges, then a maintainer takes it live.
AutomationWhere we use AI
The agentic workflows
Seven workflows run an AI agent. Each one is wired so the agent can only emit a small set of constrained outputs, listed as "allowed outputs" below. Everything else is read-only.
Sync - Skia Upstream
Agentic claude-opus-4.8Merges new commits from Google's upstream Skia, resolves the conflicts, regenerates the bindings, and opens the two paired pull requests: one in mono/skia for the submodule and one in mono/SkiaSharp. The hardest reasoning in the whole pipeline, which is why it runs on the strongest model.
Sync - Issue Triage
Agentic Copilot defaultReads new and untriaged issues, classifies them by type, area, platform, and backend, applies the right labels, and fills the triage fields on the project board. It writes a triage report as an artifact rather than posting noise on the issue.
Sync - Release Notes & API Diffs
Agentic Copilot defaultA deterministic prepare job computes the public API diff over every NuGet and generates the raw release-note data. The agent then turns that data into readable notes and opens one pull request, only when the prepare step actually found changes.
Auto API Docs Writer
Agentic claude-opus-4.7A deterministic job regenerates the XML doc stubs from the latest CI NuGets. The agent then runs a two-pass pipeline: it fills the "To be added." placeholders, then runs three correctness review passes over a scope of existing docs, editing the mdoc XML directly, and opens a pull request.
Fixer - Memory Leak
Agentic claude-opus-4.8Rotates through native-ownership and disposal risk areas in the managed bindings. A candidate must be proven with a red-to-green regression test before the workflow can file the finding and propose a fix; a quiet run is an explicit success.
Fixer - Performance
Agentic claude-opus-4.8Searches the managed layer for measurable hot-path overhead. It must prove both a BenchmarkDotNet improvement and behavior parity before it can file the finding and propose a focused optimization.
Merge Message
Agentic gpt-5.6-terraReads a pull request's issue links, code changes, commits, reviews, and validation evidence, then drafts a durable merge message that preserves the why for git history. It never edits the branch or submits the review.
How we automate the rest
Automation around the AI
A lot of the pipeline is plain GitHub Actions with no AI at all. These run before the agent to prepare its inputs, or after it to publish the result. The agent handles one part, the deterministic step handles the other, so we need both.
Deterministic prepare steps
AutomationBefore any agent runs, scripts do the mechanical work: a Cake task computes the API diff across NuGets, mdoc regenerates the XML doc stubs, and generators produce the raw release-note data. The agent starts from a clean, factual baseline rather than gathering it by hand.
Sync - Agentic Data
Automation
When an agentic run finishes, this workflow downloads its uploaded artifacts and
commits them to the aw-data branch under a key derived from the workflow
name, for example triage reports under ai-triage. It keeps a durable,
inspectable record of what the agents did.
Auto-merge docs PR
Paused
This optional workflow is currently paused. When enabled, it watches the docs writer's
pull request branch and waits for the
OpenPublishing.Build and PoliCheck Scan checks to pass with
no new warnings. When they do, it squash-merges the PR. The AI proposes the
documentation, deterministic gates verify it before it lands on main,
and the separate Go Live gate controls publication.
Go Live
Automation
The final, deliberate publish step, triggered manually by a maintainer. It opens (or
reuses) a pull request from main into the live branch;
merging that PR ships the latest API reference to Microsoft Learn.
More plain automation keeps the project moving: the website deploy and staging cleanup, the samples build, the docs submodule sync, PR backport and rebase commands, and a build artifacts comment for fork PRs. None of these use AI; they are the connective tissue the agents plug into.
Reusable instructions
The skills
A skill is a folder under .agents/skills/ with a SKILL.md file
that captures how to do one job well: the steps, the rules, and the checks. The agentic
workflows load a skill and let it drive, and maintainers invoke the same skills by hand
as slash commands. One source of truth, used by both the automation and the humans.
Upstream & Skia
- update-skia Automated
Merge a new upstream Skia milestone, fix the C shim, regenerate bindings, and update wrappers. - review-skia-update
Security-audit a Skia merge PR by diffing against upstream and verifying generated bindings. - skia-analyst
Analyze what shipped and what is missing between Skia versions, and find APIs to bind next.
Release
- release-branch
Create a release branch and trigger the build chain. - release-status
Track the release build pipeline across its stages. - release-testing
Run integration tests that verify the NuGet packages on real devices. - release-publish
Publish to NuGet, tag, create the GitHub release, and close the milestone. - release-notes Automated
Generate the website release notes and API diffs from published NuGets and git history.
API & docs
- api-add-review
Wrap new Skia functionality as C# APIs, or review an API PR for design and safety. - api-docs Automated
Write and review the XML API documentation following .NET guidelines. - pr-commit-message
Write high-signal merge and squash commit messages that preserve the why.
Issues
- issue-triage Automated
Classify an issue into structured fields, labels, and a suggested response. - issue-bulk-process
Triage and reproduce many issues in one orchestrated pass. - issue-repro
Reproduce an issue systematically and capture the result. - issue-fix
Investigate, fix, and test a bug in the C# bindings.
Performance & reliability
- memory-leak-fixer Automated
Find and fix native ownership or disposal leaks with a red-to-green regression test. - performance-fixer Automated
Find managed hot-path overhead and prove a behavior-preserving win with a benchmark.
Security & dependencies
- security-audit
Audit native dependencies for CVEs and Component Governance alerts. Read-only. - native-dependency-update
Update a native dependency such as libpng or zlib to fix a CVE or bug.
Samples & CI
- sample-scout
Scout Skia GM test files for demos worth porting to the gallery. - validate-samples
Build and validate the sample projects against CI packages. - ci-status
Collect the build health across pipelines and render a daily dashboard.
Authoring
- skill-creator
Create, improve, and evaluate the reusable skills themselves.
Want the full text? Each skill is a plain Markdown file you can read in the repository. Browse the skills folder →
How we keep it safe
Guardrails
The trust story is deliberate. The agents are boxed in by design, and nothing reaches the public API or documentation site without a human-controlled gate.
Deterministic first
The mechanical work runs as plain scripts before the agent starts. The agent only does the part that needs judgement, so its surface area is small.
Constrained outputs
Each workflow declares an allow-list of safe outputs: open a pull request, add labels, set project fields. The agent cannot make arbitrary writes to the repository.
Reviewable outputs
Code and documentation edits arrive as ordinary pull requests. Library changes require maintainer review; API docs pass deterministic gates and still need a deliberate go-live step.
Extra checks for docs
The docs writer runs three correctness review passes over its own output, and the resulting PR only auto-merges after the Microsoft Learn build passes.
Transparency. Everything here runs as public GitHub Actions you can
open and inspect, and SkiaSharp's agentic report artifacts are also copied to the
aw-data
branch. The machinery is not a black box; it is in the open, in the same repositories as
the code.
Go deeper
Read the machinery, or help build it
All of it is open. Read the workflows and skills, or open a pull request to make them better.