diff --git a/.github/actions/install/action.yml b/.github/actions/install/action.yml
new file mode 100644
index 000000000..be6747f13
--- /dev/null
+++ b/.github/actions/install/action.yml
@@ -0,0 +1,49 @@
+name: "Browsercore install"
+description: "Install deps for the project browsercore"
+
+runs:
+  using: "composite"
+
+  steps:
+    - name: install v8
+      shell: bash
+      run: |
+        mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug
+        ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug/libc_v8.a
+
+        mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release
+        ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release/libc_v8.a
+
+    - name: install deps
+      shell: bash
+      run: |
+        ln -s /usr/local/lib/libiconv vendor/libiconv
+
+        ln -s /usr/local/lib/netsurf/build vendor/netsurf/build
+        ln -s /usr/local/lib/netsurf/lib vendor/netsurf/lib
+        ln -s /usr/local/lib/netsurf/include vendor/netsurf/include
+
+    # detect file change
+    - uses: dorny/paths-filter@v3.0.2
+      id: changes
+      with:
+        filters: |
+          netsurf:
+            - 'vendor/netsurf/**'
+
+    # if a vendor has changed, install build dependencies.
+    - name: install build dependencies
+      if: steps.changes.outputs.netsurf == 'true'
+      shell: bash
+      run: |
+        apt update && \
+        apt install -y git curl bash xz-utils python3 ca-certificates pkg-config \
+        libglib2.0-dev gperf libexpat1-dev cmake build-essential
+
+    # if netsurf has changed, force a rebuild.
+    - name: re-build netsurf
+      if: steps.changes.outputs.netsurf == 'true'
+      shell: bash
+      run: |
+        make clean-netsurf
+        make install-netsurf
diff --git a/.github/workflows/wpt.yml b/.github/workflows/wpt.yml
index 33fb2c9e7..2eb77e66c 100644
--- a/.github/workflows/wpt.yml
+++ b/.github/workflows/wpt.yml
@@ -27,6 +27,7 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
 
     paths:
+      - ".github/**"
       - "build.zig"
       - "src/**/*.zig"
       - "src/*.zig"
@@ -35,6 +36,11 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  pull-requests: read # required for dorny/paths-filter
+  contents: read
+  packages: read
+
 jobs:
   wpt:
     name: web platform tests
@@ -50,28 +56,14 @@ jobs:
        password: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_CI_PAT }}
           # fetch submodules recusively, to get jsruntime-lib submodules also.
           submodules: recursive
 
-      - name: install v8
-        run: |
-          mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug
-          ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug/libc_v8.a
-
-          mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release
-          ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release/libc_v8.a
-
-      - name: install deps
-        run: |
-          ln -s /usr/local/lib/libiconv vendor/libiconv
-
-          ln -s /usr/local/lib/netsurf/build vendor/netsurf/build
-          ln -s /usr/local/lib/netsurf/lib vendor/netsurf/lib
-          ln -s /usr/local/lib/netsurf/include vendor/netsurf/include
+      - uses: ./.github/actions/install
 
       - run: zig build wpt -Dengine=v8 -- --safe --summary
 
@@ -88,7 +80,7 @@ jobs:
           echo "${{github.sha}}" > commit.txt
 
       - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: wpt-results
           path: |
@@ -112,7 +104,7 @@ jobs:
 
     steps:
       - name: download artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: wpt-results
 
diff --git a/.github/workflows/zig-fmt.yml b/.github/workflows/zig-fmt.yml
index c20b35fdf..ab90714d7 100644
--- a/.github/workflows/zig-fmt.yml
+++ b/.github/workflows/zig-fmt.yml
@@ -11,6 +11,7 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
 
     paths:
+      - ".github/**"
       - "build.zig"
       - "src/**/*.zig"
       - "src/*.zig"
@@ -34,7 +35,7 @@ jobs:
       zig_fmt_errs: ${{ steps.fmt.outputs.zig_fmt_errs }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/zig-test.yml b/.github/workflows/zig-test.yml
index 81474dc83..1850339d3 100644
--- a/.github/workflows/zig-test.yml
+++ b/.github/workflows/zig-test.yml
@@ -26,6 +26,7 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
 
     paths:
+      - ".github/**"
       - "build.zig"
       - "src/**/*.zig"
       - "src/*.zig"
@@ -33,6 +34,11 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  pull-requests: read # required for dorny/paths-filter
+  contents: read
+  packages: read
+
 jobs:
   zig-build-dev:
     name: zig build dev
@@ -48,28 +54,14 @@ jobs:
        password: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_CI_PAT }}
           # fetch submodules recusively, to get jsruntime-lib submodules also.
           submodules: recursive
 
-      - name: install v8
-        run: |
-          mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug
-          ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug/libc_v8.a
-
-          mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release
-          ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release/libc_v8.a
-
-      - name: install deps
-        run: |
-          ln -s /usr/local/lib/libiconv vendor/libiconv
-
-          ln -s /usr/local/lib/netsurf/build vendor/netsurf/build
-          ln -s /usr/local/lib/netsurf/lib vendor/netsurf/lib
-          ln -s /usr/local/lib/netsurf/include vendor/netsurf/include
+      - uses: ./.github/actions/install
 
       - name: zig build debug
         run: zig build -Dengine=v8
@@ -88,28 +80,14 @@ jobs:
        password: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_CI_PAT }}
           # fetch submodules recusively, to get jsruntime-lib submodules also.
           submodules: recursive
 
-      - name: install v8
-        run: |
-          mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug
-          ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug/libc_v8.a
-
-          mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release
-          ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release/libc_v8.a
-
-      - name: install deps
-        run: |
-          ln -s /usr/local/lib/libiconv vendor/libiconv
-
-          ln -s /usr/local/lib/netsurf/build vendor/netsurf/build
-          ln -s /usr/local/lib/netsurf/lib vendor/netsurf/lib
-          ln -s /usr/local/lib/netsurf/include vendor/netsurf/include
+      - uses: ./.github/actions/install
 
       - name: zig build release
         run: zig build -Doptimize=ReleaseSafe -Dengine=v8
@@ -128,28 +106,14 @@ jobs:
        password: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
           token: ${{ secrets.GH_CI_PAT }}
           # fetch submodules recusively, to get jsruntime-lib submodules also.
           submodules: recursive
 
-      - name: install v8
-        run: |
-          mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug
-          ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/debug/libc_v8.a
-
-          mkdir -p vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release
-          ln -s /usr/local/lib/libc_v8.a vendor/jsruntime-lib/vendor/v8/${{env.ARCH}}/release/libc_v8.a
-
-      - name: install deps
-        run: |
-          ln -s /usr/local/lib/libiconv vendor/libiconv
-
-          ln -s /usr/local/lib/netsurf/build vendor/netsurf/build
-          ln -s /usr/local/lib/netsurf/lib vendor/netsurf/lib
-          ln -s /usr/local/lib/netsurf/include vendor/netsurf/include
+      - uses: ./.github/actions/install
 
       - name: zig build test
         run: zig build test -Dengine=v8 -- --json > bench.json
@@ -159,7 +123,7 @@ jobs:
           echo "${{github.sha}}" > commit.txt
 
       - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: bench-results
           path: |
@@ -183,7 +147,7 @@ jobs:
 
     steps:
       - name: download artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: bench-results