Vite Electron Builder Boilerplate
Vite+Electron =
🔥
This is template for secure electron applications. Written following the latest safety requirements, recommendations and best practices.
Under the hood is used Vite — superfast, nextgen bundler, and electron-builder for compilation.
Support
-
This template maintained by Alex Kozack. You can
💖 sponsor him for continued development of this template. -
Found a problem? Pull requests are welcome.
-
If you have ideas, questions or suggestions - Welcome to discussions.
😊
Get started
Follow these steps to get started with this template:
- Click the Use this template button (you must be logged in) or just clone this repo.
- If you want to use another package manager don't forget edit
.github/workflows-- it usesnpmby default.
That's all you need.
Note: This template uses npm v7 feature — Installing Peer Dependencies Automatically. If you are using a different package manager, you may need to install some peerDependencies manually.
Note: Find more usefull forks here.
Features
Electron 
- Template use the latest electron version with all the latest security patches.
- The architecture of the application is built according to the security guides and best practices.
- The latest version of the electron-builder is used to compile the application.
Vite 
- Vite is used to bundle all source codes. This is an extremely fast packer that has a bunch of great features. You can learn more about how it is arranged in this video.
- Vite supports reading
.envfiles. You can also specify types of your environment variables intypes/env.d.ts. - Hot reloads for
MainandRendererprocesses.
Vite provides you with many useful features, such as: TypeScript, TSX/JSX, CSS/JSON Importing, CSS Modules, Web Assembly and much more.
TypeScript 
(optional)
- The Latest TypeScript is used for all source code.
- Vite supports TypeScript out of the box. However, it does not support type checking.
- Code formatting rules follow the latest TypeScript recommendations and best practices thanks to @typescript-eslint/eslint-plugin.
- Automatically create interface declarations for all APIs that have been passed to
electron.contextBridge.exposeInMainWorld. Thanks dts-for-context-bridge.
See this discussion if you want completly remove TypeScript.
See examples of web pages for different frameworks.
Continuous Integration
- The configured workflow for check the types for each push and PR.
- The configured workflow for check the code style for each push and PR.
- Automatic tests used Vitest
-- A blazing fast test framework powered by Vite.
- Unit tests are placed in each package and run separately.
- End-to-end tests placed in root
testsdirectory and used playwright.
Continuous delivery
- Each time you push changes to the
mainbranch,releaseworkflow starts, which creates release draft.- The version is automatically set based on the current date in the format
yy.mm.dd-minutes. - Notes are automatically generated and added to the release draft.
- Code signing supported. See
compilejob inreleaseworkflow.
- The version is automatically set based on the current date in the format
- Auto-update is supported. After the release will be published, all client applications will download the new version and install updates silently.
How it works
The template required a minimum dependencies. Only Vite is used for building, nothing more.
Project Structure
The structure of this template is very similar to the structure of a monorepo.
The entire source code of the program is divided into three modules (packages) that are bundled each independently:
packages/mainElectron main script.packages/preloadUsed inBrowserWindow.webPreferences.preload. See Checklist: Security Recommendations.packages/rendererElectron web page.
Build web resources
Packages main and preload are built in library mode as it is a simple javascript. renderer package build as regular web app.
Compile App
Next step is run packaging and compilation a ready for distribution Electron app for macOS, Windows and Linux with "auto update" support out of the box.
To do this, using the electron-builder:
- In npm script
compile: This script is configured to compile the application as quickly as possible. It is not ready for distribution, is compiled only for the current platform and is used for debugging. - In GitHub Action: The application is compiled for any platform and ready-to-distribute files are automatically added to the draft GitHub release.
Working with dependencies
There is one important nuance when working with dependencies. On build stage Vite analyze your code, finds all the imported dependencies, applies tree shaking, optimization and bundle them inside the output source files. So when you write something like that:
// source.ts
import {createApp} from 'vue'
createApp()
It turns into:
// bundle.js
function createApp() { /* ... */ }
createApp()
And there are really no imports left in runtime.
But it doesn't always work. Vite was designed to work with browser-oriented packages. So it is not able to bundle Node built-in modules, or native dependencies, or some Node.js specific packages, or Electron itself.
Modules that Vite is unable to bundle are forced to be supplied as external in vite.config.js. External modules are not optimized and their imports remain in runtime.
// source.ts
import {writeFile} from 'fs'
writeFile()
// bundle.js
const {writeFile} = require('fs')
writeFile()
Using external modules in renderer
According to Electron's security guidelines, Node.js integration is disabled for remote content. This means that you cannot call any Node.js api in the packages/renderer directly. This also means you can't import external modules in runtime in renderer:
// renderer.bundle.js
const {writeFile} = require('fs') // ReferenceError: require is not defined
writeFile()
To use external modules in Renderer you must describe the interface in the packages/preload where Node.js api is allowed:
// packages/preload/src/index.ts
import type {BinaryLike} from 'crypto';
import {createHash} from 'crypto';
contextBridge.exposeInMainWorld('nodeCrypto', {
sha256sum(data: BinaryLike) {
const hash = createHash('sha256');
hash.update(data);
return hash.digest('hex');
},
});
The dts-cb utility will automatically generate an interface for TS:
// packages/preload/exposedInMainWorld.d.ts
interface Window {
readonly nodeCrypto: { sha256sum(data: import("crypto").BinaryLike): string; };
}
And now, you can safely use the registered method:
// packages/renderer/src/App.vue
window.nodeCrypto.sha256sum('data')
Read more about Security Considerations.
Modes and Environment Variables
All environment variables set as part of the import.meta, so you can access them as follows: import.meta.env.
If you are using a TypeScript and want to get Code completion you must add all the environment variables to the ImportMetaEnv in types/env.d.ts.
The mode option is used to specify the value of import.meta.env.MODE and the corresponding environment variables files that needs to be loaded.
By default, there are two modes:
productionis used by defaultdevelopmentis used bynpm run watchscript
When running building, environment variables are loaded from the following files in your project root:
.env # loaded in all cases
.env.local # loaded in all cases, ignored by git
.env.[mode] # only loaded in specified env mode
.env.[mode].local # only loaded in specified env mode, ignored by git
To prevent accidentally leaking env variables to the client, only variables prefixed with VITE_ are exposed to your Vite-processed code. e.g. the following file:
DB_PASSWORD=foobar
VITE_SOME_KEY=123
Only VITE_SOME_KEY will be exposed as import.meta.env.VITE_SOME_KEY to your client source code, but DB_PASSWORD will not.
Contribution
See Contributing Guide.
21 Nov 15, 2022
3.1k Dec 26, 2022
10 Aug 16, 2022
2.5k Dec 26, 2022
34k Dec 28, 2022
21.7k Jan 1, 2023
9.8k Jan 3, 2023
3k Dec 30, 2022
5k Dec 31, 2022
268 Dec 27, 2022
2 Sep 21, 2021
1 Jul 6, 2022
2 Jul 21, 2022
16 Dec 13, 2022
3 Sep 21, 2022
2 Jun 6, 2022
2 Feb 17, 2022
14 Nov 23, 2022
5 Aug 10, 2022