Electron auto update

Skill Sheshiyer/skill-clusters/skills/electron-auto-update

Ship updates to installed Electron apps — autoUpdater / electron-updater, update feeds (S3/GitHub/generic), signed differential updates, and staged rollouts with rollback. USE WHEN adding or debugging auto-update, choosing an update server, or handling update events safely. Updates must be signed.From its SKILL.md

Install

npx -y skills add Sheshiyer/skill-clusters --skill electron-auto-update

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.2 KB, 418 tokens by cl100k_base, as published. Nobody here has run it

Electron Auto-Update

Delivering new versions after install. Two layers: Electron's built-in autoUpdater (uses Squirrel on macOS/Windows) and electron-updater (from electron-builder — feeds, deltas, more control). Most electron-builder apps use electron-updater.

The flow

CI publishes signed artifacts + a manifest (latest.yml/latest-mac.yml) to a feed (GitHub Releases, S3, or a generic HTTPS server).
The app checks the feed (autoUpdater.checkForUpdates() / electron-updater), downloads in the background, and installs on quit (or on user confirm).
Signature is verified before applying — updates inherit the same signing as the installer (electron-builder-packaging); an unsigned/forged update must be rejected.

Handle the events (don't silently swap binaries)

autoUpdater.on('update-available', /* notify */);
autoUpdater.on('download-progress', /* show progress */);
autoUpdater.on('update-downloaded', () => promptThenQuitAndInstall());
autoUpdater.on('error', /* log + surface, don't crash */);

Rules

Updates must be signed/verified — the update channel is a code-execution channel; treat it like one.
Serve the feed over HTTPS; pin the host; never an unauthenticated HTTP feed.
Stage rollouts (a percentage) and keep the previous version available for rollback.
macOS auto-update requires signing + notarization; Windows requires a signed installer + matching feed.
Let the user defer; install on quit by default — don't yank the app out from under work.

Guardrails

Signed, HTTPS-only, verified-before-apply updates — no exceptions.
Staged rollout + rollback path; surface errors instead of failing silently.
Reuse the packaging signing identity (electron-builder-packaging).

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.