Skip to content

feat: add DISABLE_AUTO_UPDATES property to MSI installer#3280

Merged
jeanfbrito merged 4 commits intodevfrom
feat/msi-disable-auto-updates
Mar 27, 2026
Merged

feat: add DISABLE_AUTO_UPDATES property to MSI installer#3280
jeanfbrito merged 4 commits intodevfrom
feat/msi-disable-auto-updates

Conversation

@jeanfbrito
Copy link
Copy Markdown
Member

@jeanfbrito jeanfbrito commented Mar 27, 2026

Summary

Adds DISABLE_AUTO_UPDATES=1 as a public MSI property for enterprise deployments, bringing the MSI installer to parity with the NSIS /disableAutoUpdates flag.

Ref: https://rocketchat.atlassian.net/browse/CORE-2016

  • Add build/msiProjectCreated.js hook that injects a WiX custom action into the MSI project
  • When DISABLE_AUTO_UPDATES=1 is passed to msiexec, writes resources/update.json with canUpdate: false and autoUpdate: false
  • Register the hook in electron-builder.json via the msiProjectCreated option
  • No runtime changes needed — the app already reads and respects update.json

Usage

msiexec /i rocketchat-x.y.z-win-x64.msi DISABLE_AUTO_UPDATES=1 /qn

How it works

Uses electron-builder's msiProjectCreated hook to inject WiX XML into the generated .wxs project before compilation:

  1. Declares a DISABLE_AUTO_UPDATES public property (Secure="yes" for elevated/managed installs)
  2. Adds a deferred VBScript custom action scheduled after InstallFiles
  3. When the property is set to 1, writes resources/update.json with updates disabled
  4. The app's existing update.json reader (src/updates/main.ts) picks this up on launch and skips all update logic

Test plan

  • Build MSI: npx electron-builder --win msi --x64
  • Install with property: msiexec /i rocketchat.msi DISABLE_AUTO_UPDATES=1 /qn → verify resources\update.json exists with correct content
  • Install without property: msiexec /i rocketchat.msi /qn → verify update.json does NOT exist
  • Launch app after install with property → verify updates are disabled in About dialog
  • MSI Repair: msiexec /fa rocketchat.msi → verify update.json persists

Summary by CodeRabbit

  • New Features

    • Windows MSI installer now disables automatic updates during setup and writes a persistent update config so auto-updates remain off after install.
    • Installer actions run only during installation (not on uninstall).
  • Chores

    • Build configuration updated to invoke an MSI lifecycle hook and to build/publish MSI artifacts.
    • Package version bumped to 4.14.0-alpha.1.

Allow enterprise admins to disable auto-updates during MSI deployment:
msiexec /i rocketchat.msi DISABLE_AUTO_UPDATES=1 /qn

Uses electron-builder's msiProjectCreated hook to inject a WiX custom
action that writes resources/update.json with canUpdate and autoUpdate
set to false, matching the existing NSIS /disableAutoUpdates behavior.
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 27, 2026

Walkthrough

Adds a new MSI build hook that modifies the generated WiX .wxs to expose a DISABLE_AUTO_UPDATES secure public Property, inject two deferred VBScript custom actions to write resources/update.json disabling auto-updates at install time, and registers the hook in build configuration; CI now builds and publishes MSI artifacts.

Changes

Cohort / File(s) Summary
MSI Build Hook
build/msiProjectCreated.js
New async hook that reads the generated WiX .wxs, injects a secure public DISABLE_AUTO_UPDATES Property, adds two deferred VBScript custom actions (SetWriteUpdateJsonDir, WriteUpdateJson) that create resources/update.json with {"canUpdate":false,"autoUpdate":false}, inserts install-only scheduling (NOT REMOVE~="ALL"), validates injection, and writes back the file.
Build Configuration
electron-builder.json
Registered MSI hook by adding msiProjectCreated: "./build/msiProjectCreated.js".
CI / Artifacts
.github/workflows/pull-request-build.yml
Updated Windows build step to include msi in electron-builder targets, extended upload filters and artifact discovery to include rocketchat-*.msi.
Package metadata
package.json
Bumped package version 4.14.0-alpha.04.14.0-alpha.1.

Sequence Diagram(s)

sequenceDiagram
    autonumber
    participant Build as Build System
    participant Hook as msiProjectCreated Hook
    participant WiX as WiX .wxs
    participant MSI as MSI Build/Installer
    participant VBScript as Deferred VBScript CA
    participant FS as Target Filesystem

    Build->>Hook: invoke with `projectFile` (.wxs)
    Hook->>WiX: read .wxs XML
    Hook->>WiX: inject `DISABLE_AUTO_UPDATES` Property, VBScript CAs, and InstallExecuteSequence entries
    Hook->>WiX: validate injection and write modified .wxs
    Build->>MSI: continue build -> produce MSI
    MSI->>VBScript: run `SetWriteUpdateJsonDir` (deferred) to set CustomActionData
    MSI->>VBScript: run `WriteUpdateJson` (deferred) using CustomActionData
    VBScript->>FS: ensure `resources` folder exists and write `resources/update.json` with {"canUpdate":false,"autoUpdate":false}
Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested labels

type: feature

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check ✅ Passed The PR fully implements all coding requirements from CORE-2016: exposes DISABLE_AUTO_UPDATES as an MSI public property via msiProjectCreated hook, injects WiX custom actions to write update.json when the property is set, and updates CI/build configuration to produce MSI artifacts.
Out of Scope Changes check ✅ Passed All changes are within scope: build/msiProjectCreated.js implements the core feature, electron-builder.json registers the hook, package.json version bump is standard, and GitHub workflow updates enable MSI artifact generation and CI validation.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check ✅ Passed The PR title directly and clearly summarizes the main change: adding a DISABLE_AUTO_UPDATES property to the MSI installer, which is the primary feature implemented across the new hook module and build configuration.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
build/msiProjectCreated.js (2)

50-65: String-based XML manipulation is functional but fragile.

The current approach uses string replacement to inject WiX elements. This works for electron-builder's predictable output but could break if the generated .wxs structure changes. For a build hook, this pragmatic approach is acceptable, but consider documenting the assumption about the expected XML structure in a comment.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@build/msiProjectCreated.js` around lines 50 - 65, The XML string manipulation
using xml.replace on '</InstallExecuteSequence>' and '</Product>' is fragile;
add a clear comment above this block (referencing the xml variable and the
sequenceEntries and propertyAndActions variables) stating the assumption that
the .wxs output always contains those closing tags in the expected structure and
that this is a pragmatic choice for the build hook; also mention potential risks
and that a proper XML parser should be used if the .wxs structure may vary.

26-44: Consider adding error handling to the VBScript custom action.

The VBScript lacks error handling. If the resources folder doesn't exist or there's a permission issue, the installer will fail with a potentially cryptic error due to Return="check". While resources should exist in a typical Electron build (it contains app.asar), adding basic error handling would improve robustness and provide clearer diagnostics.

💡 Optional: Add error handling with descriptive failure
     <CustomAction Id="WriteUpdateJson"
       Script="vbscript"
       Execute="deferred"
       Impersonate="no"
       Return="check">
       <![CDATA[
+        On Error Resume Next
         Dim fso, installDir, filePath, f
         Set fso = CreateObject("Scripting.FileSystemObject")
         installDir = Session.Property("CustomActionData")
         If Right(installDir, 1) <> "\" Then installDir = installDir & "\"
         filePath = installDir & "resources\update.json"
+        If Not fso.FolderExists(installDir & "resources") Then
+          Err.Raise 1, "WriteUpdateJson", "resources folder not found: " & installDir & "resources"
+        End If
         Set f = fso.CreateTextFile(filePath, True)
+        If Err.Number <> 0 Then
+          Err.Raise Err.Number, "WriteUpdateJson", "Failed to create " & filePath & ": " & Err.Description
+        End If
         f.WriteLine "{"
         f.WriteLine "  ""canUpdate"": false,"
         f.WriteLine "  ""autoUpdate"": false"
         f.WriteLine "}"
         f.Close
       ]]>
     </CustomAction>
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@build/msiProjectCreated.js` around lines 26 - 44, The WriteUpdateJson custom
action currently writes update.json without any error handling; wrap the
VBScript in an error-handling block (use On Error Resume Next), ensure the
target folder exists by checking fso.FolderExists on the directory derived from
Session.Property("CustomActionData") and create it with fso.CreateFolder if
missing, and after each filesystem operation check Err.Number and on error call
Session.Log with Err.Number and Err.Description and then raise the error
(Err.Raise) so the installer fails with a clear diagnostic; reference the
CustomAction Id "WriteUpdateJson", the Session.Property("CustomActionData")
value, the filePath variable and the fso.CreateTextFile operation when making
these changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@build/msiProjectCreated.js`:
- Around line 31-42: The VBScript uses "\\" (two backslashes) where VBScript
string literals should use a single backslash "\"; update the checks and
concatenations around installDir and filePath so Right(installDir, 1) compares
to "\" (one backslash) and append "\" when missing, and build filePath using a
single "\" before "resources\\update.json" (i.e., "resources\update.json") so
CreateTextFile receives a correctly formed path; locate these fixes around the
installDir variable, the Right(...) call, and the filePath assignment in this
snippet (symbols: installDir, Right, filePath, fso.CreateTextFile).

---

Nitpick comments:
In `@build/msiProjectCreated.js`:
- Around line 50-65: The XML string manipulation using xml.replace on
'</InstallExecuteSequence>' and '</Product>' is fragile; add a clear comment
above this block (referencing the xml variable and the sequenceEntries and
propertyAndActions variables) stating the assumption that the .wxs output always
contains those closing tags in the expected structure and that this is a
pragmatic choice for the build hook; also mention potential risks and that a
proper XML parser should be used if the .wxs structure may vary.
- Around line 26-44: The WriteUpdateJson custom action currently writes
update.json without any error handling; wrap the VBScript in an error-handling
block (use On Error Resume Next), ensure the target folder exists by checking
fso.FolderExists on the directory derived from
Session.Property("CustomActionData") and create it with fso.CreateFolder if
missing, and after each filesystem operation check Err.Number and on error call
Session.Log with Err.Number and Err.Description and then raise the error
(Err.Raise) so the installer fails with a clear diagnostic; reference the
CustomAction Id "WriteUpdateJson", the Session.Property("CustomActionData")
value, the filePath variable and the fso.CreateTextFile operation when making
these changes.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3da48103-8fb1-41c7-9a2b-9d8187a79e8a

📥 Commits

Reviewing files that changed from the base of the PR and between 1ed4bd6 and f78154b.

📒 Files selected for processing (2)
  • build/msiProjectCreated.js
  • electron-builder.json
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
  • GitHub Check: check (macos-latest)
  • GitHub Check: check (windows-latest)
  • GitHub Check: check (ubuntu-latest)
🔇 Additional comments (3)
build/msiProjectCreated.js (2)

46-48: LGTM - Custom action scheduling is correct.

The scheduling ensures SetWriteUpdateJsonDir (immediate) runs before WriteUpdateJson (deferred) to set CustomActionData, and WriteUpdateJson runs after InstallFiles so the resources folder exists. The deferred action with Impersonate="no" correctly uses elevated privileges for writing to Program Files.


18-24: LGTM - Property declaration and custom action setup are correct.

Secure="yes" is properly set for the public property, allowing it to be passed via msiexec command line. The SetWriteUpdateJsonDir action correctly passes [APPLICATIONFOLDER] to the deferred action via the Property attribute (which becomes CustomActionData).

electron-builder.json (1)

106-106: Hook configuration correctly placed and properly formatted.

The msiProjectCreated hook is a valid electron-builder option that runs after the MSI project is created on disk but before the final .msi package is compiled. The configuration at line 106 correctly specifies the hook handler path, allowing you to modify the generated WiX project file before packaging.

- Add error handling to VBScript: check resources/ exists, validate
  file creation, and raise descriptive errors on failure
- Guard custom action with NOT REMOVE~="ALL" to skip during uninstall
- Add build-time validation that throws if XML injection failed
- Document implementation assumptions in JSDoc header
@github-actions
Copy link
Copy Markdown

@github-actions
Copy link
Copy Markdown

github-actions bot commented Mar 27, 2026

@github-actions
Copy link
Copy Markdown

Add MSI target to the Windows electron-builder command and include
.msi files in Wasabi uploads and PR comment artifact links.
@jeanfbrito jeanfbrito changed the title CORE-2016 feat: add DISABLE_AUTO_UPDATES property to MSI installer feat: add DISABLE_AUTO_UPDATES property to MSI installer Mar 27, 2026
@jeanfbrito jeanfbrito merged commit 4da3644 into dev Mar 27, 2026
9 checks passed
@jeanfbrito jeanfbrito deleted the feat/msi-disable-auto-updates branch March 27, 2026 21:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant