fix(v3/updater): stop the periodic check from re-downloading a staged update

[manduinca]

Description

With Config.CheckInterval set, periodicCheckLoop skips a tick only while the updater is checking, downloading, verifying or installing. Once an update is staged (StateReady), the next tick runs CheckAndInstall again, which finds the same release and downloads the whole artifact once more, every interval until the app restarts. The comment in TestInit_CheckInterval_TicksProviderAndStops already says the loop ignores StateReady; the condition just didn't include it.

The loop now skips StateReady as well. A release published after an update is already staged is picked up by the first check after Restart, not before; checking for a newer version while one is staged would need a version comparison in that path, which seemed out of scope for this fix.

Fixes #6188

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• WEP (proposal only; no implementation)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

TestInit_CheckInterval_DoesNotRedownloadStagedUpdate runs the updater with a 20 ms interval, waits for the update to be staged, lets several more ticks pass and checks that the provider served a single download. On master it fails with expected 1 download while the update is staged, got 11; with the change it passes, also under -race.

From v3: go test ./pkg/updater/... passes (all six packages), go vet ./pkg/updater/ is clean and both changed files are gofmt-clean.

• Windows
• macOS
• Linux

Test Configuration

macOS 26 (arm64), Go 1.26.2. Package tests only; wails doctor was not run since no app was built.

Checklist:

• (v2 only) I have updated website/src/pages/changelog.mdx with details of this PR (v3 changelog entries are added automatically)
• My code follows the general coding style of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Summary by CodeRabbit

• Bug Fixes
  • Staged updates remain ready for restart instead of being checked and downloaded again during periodic checks.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: wailsapp/wails/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 74a55fff-b7ec-407f-b32a-77d4ade72dfa

📥 Commits

Reviewing files that changed from the base of the PR and between a699216 and 1e4d5bf.

📒 Files selected for processing (2)

• v3/pkg/updater/updater.go
• v3/pkg/updater/updater_test.go

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The periodic updater now skips checks in StateReady. A regression test verifies that additional timer ticks do not trigger another download while an update remains staged.

Changes

Periodic update checks

Layer / File(s)	Summary
Skip checks for staged updates v3/pkg/updater/updater.go, v3/pkg/updater/updater_test.go	The periodic loop skips CheckAndInstall when the updater is in StateReady. The regression test verifies that the provider downloads only once after additional timer ticks.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: taliesin-ai

Merge Risk: ⚪ Minimal · up to 1e4d5

Periodic checks preserve a staged update instead of repeatedly downloading it. Restart and manual checks remain available; no actionable merge-blocking risk remains.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1e4d5

The change prevents repeated downloads without changing update verification or installation authority. It intentionally pauses automatic discovery of newer releases while an update remains staged; restart or a manual check is needed to resume discovery.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated exposure change concerns update discovery within an application configured for periodic checking. If a newer release contains a security fix, its automatic discovery is deferred while the existing update remains staged; no affected security release or deployment was established.

Trust Boundaries and Controls

• observed — The changed gate suppresses a new update operation rather than bypassing verification. The inspected staging path still selects the pending release's provider and calls verification before making the artifact ready for restart.

Resilience and Maintainability Implications

• observed — Verification and installation failures remove temporary staging data and transition to StateError, which the new periodic gate does not exclude. Successful staging instead remains available for restart without repeated timer-driven replacement.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary fix: preventing the periodic updater check from re-downloading a staged update.
Description check	✅ Passed	The description is complete and follows the repository template. It explains the bug, links issue #6188, identifies the behavioral change, documents testing and environment details, and marks the rele…
Linked Issues check	✅ Passed	The PR satisfies the coding requirement in #6188. periodicCheckLoop now skips StateReady in addition to the active operation states. This prevents another periodic CheckAndInstall call while the…
Out of Scope Changes check	✅ Passed	The changes stay within #6188. The source change is limited to v3 updater periodic-loop state handling. The added test verifies the reported re-download behavior. No unrelated product behavior or scop…

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the ticking clock
The staged update rests in place
No second download hops along
The timer passes, calm and clear
One bundle waits for restart time}

_{Comment @coderabbitai help to get the list of available commands.}

[taliesin-ai]

Automated v3 GA test run (taliesin-ai) for head 1e4d5bfd74fd9f2bd9edd444d1bca85c86cdc504, run 2026-10-04 against master baseline f21e67fa.

Platform	CLI build	Unit tests (./pkg/... ./internal/...)	Example build (examples/window)
macOS (arm64)	PASS	PASS (51/51 pkgs)	PASS
Windows (amd64)	PASS	51/52: internal/webview2/pkg/edge FAIL*	PASS
Linux	not tested (node offline)

* Same failure on master f21e67fa, so this PR doesn't introduce it. TestCookieManager needs a live WebView2 controller. It times out after 60s in the non-interactive SSH session the runner uses, so this is a test-environment limitation and not a code failure.

The app was not launched (no GUI session over SSH). This run doesn't review or approve the PR.