Bug/138 bug update information source mismatch

[stiwicourage]

Summary

• Aligned the self-update lookup path with the CI install path by pinning both to PSGallery.
• Preserved lookup candidate metadata inside the self-update plan so update decisions and tests can reason about the same repository-backed result.
• Kept the user-facing nova update no-update output in its original friendly form (You're up to date!).
• Added regression coverage for the pinned lookup script and for the no-update CLI path.
• This change was needed because CI install and nova update lookup were using different implicit source assumptions, which made the update flow harder to reason about and contributed to the earlier mismatch investigation.
• Follow-up: the prerelease ordering policy for labels such as preview* vs beta* is still a separate concern if Nova needs custom channel precedence.

Affected area

• nova CLI or command routing
• Public PowerShell cmdlet behavior
• Scaffolding or project.json handling
• Build, test, analyzer, coverage, or CI helper flow
• Package, raw upload, or package metadata workflow
• Publish, release, semantic-release, or GitHub Actions automation
• Self-update or notification preference behavior
• Contributor documentation (README.md, CONTRIBUTING.md, repository workflow docs)
• End-user docs (docs/*.html)
• Command help (docs/NovaModuleTools/en-US/*.md)
• src/resources/example/
• Dependency or manifest changes (package.json, workflow dependencies, release tooling)
• Security-sensitive change
• Documentation-only change
• Other

Review guidance

• Start with src/resources/update/ModuleUpdateLookup.ps1.txt and scripts/build/ci/Install-CiPowerShellModules.ps1 to review the repository pinning.
• Then review src/private/update/ConvertToNovaModuleSelfUpdatePlan.ps1 and src/private/update/GetNovaModuleSelfUpdatePlan.ps1 for how lookup metadata is preserved through the update plan.
• Finally review src/private/cli/FormatNovaCliCommandResult.ps1 and tests/UpdateNotification.Tests.ps1 for the restored no-update UX and regression coverage.
• Primary files touched:
  • scripts/build/ci/Install-CiPowerShellModules.ps1
  • src/resources/update/ModuleUpdateLookup.ps1.txt
  • src/private/update/ConvertToNovaModuleSelfUpdatePlan.ps1
  • src/private/update/GetNovaModuleSelfUpdatePlan.ps1
  • src/private/cli/FormatNovaCliCommandResult.ps1
  • tests/UpdateNotification.Tests.ps1
• Trade-off: the implementation aligns the source assumptions and keeps the friendly CLI wording, but it does not introduce a custom prerelease ordering policy across labels.

Validation

• Invoke-NovaBuild
• Test-NovaBuild
• ./scripts/build/Invoke-ScriptAnalyzerCI.ps1
• ./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1
• Targeted Nova workflow validated (% nova build, % nova test, % nova merge, % nova deploy,
  % nova publish,
  % nova release, % nova update, % nova notification, or % nova init as relevant)
• Docs/example only; executable validation not needed

Validation notes:

Focused self-update coverage:

cd "/Users/stiwi.courage/workspace/couragedk/NovaModuleTools" && \
  pwsh -NoLogo -NoProfile -Command 'Import-Module NovaModuleTools -Force; Invoke-NovaBuild; Invoke-Pester ./tests/UpdateNotification.Tests.ps1 -Output Detailed' | cat

Result:
- Tests Passed: 51, Failed: 0

Additional module-level regression check:

cd "/Users/stiwi.courage/workspace/couragedk/NovaModuleTools" && \
  pwsh -NoLogo -NoProfile -Command 'Import-Module NovaModuleTools -Force; Invoke-NovaBuild; Invoke-Pester ./tests/Module.Tests.ps1 -Output Detailed' | cat

Result:
- Tests Passed: 4, Failed: 0

Direct built-module update workflow check:

cd "/Users/stiwi.courage/workspace/couragedk/NovaModuleTools" && \
  pwsh -NoLogo -NoProfile -Command 'Import-Module NovaModuleTools -Force; Invoke-NovaBuild; Remove-Module NovaModuleTools -ErrorAction SilentlyContinue; Import-Module ./dist/NovaModuleTools -Force; $result = @(Invoke-NovaCli update -WhatIf); $result | ForEach-Object { $_ }' | cat

Observed output:
- You're up to date!
- NovaModuleTools 2.0.0-beta01 is currently the newest version available.

Code Health reviews for the touched CLI/test files returned 10.0, and the pre-commit Code Health safeguard passed.

Documentation and release follow-up

• README.md reviewed and updated if contributor workflow, architecture, CI, release, or automation changed
• CONTRIBUTING.md reviewed and updated if contribution expectations or review guidance changed
• CHANGELOG.md reviewed and updated if the change matters to users, maintainers, or contributors
• docs/NovaModuleTools/en-US/ help updated if a public command or CLI behavior changed
• docs/*.html updated if end-user workflows or examples changed
• src/resources/example/ reviewed and updated if the real-world project layout, package model, or upload workflow
  changed
• No documentation, changelog, or example updates were needed

Maintainability, compatibility, and risk

• Code Health / maintainability impact considered
• No breaking change
• Breaking change
• Security-sensitive change
• CI, workflow, or release-pipeline impact
• Dependency-review impact

Risk, rollout, or rollback notes:

Compatibility impact is low: the change pins the install and lookup path to PSGallery and keeps the original no-update CLI wording.

Rollback is straightforward:
- remove the explicit `-Repository PSGallery` pinning in the CI installer and lookup script
- drop the lookup metadata fields from the self-update plan adapter
- remove the related regression tests in `tests/UpdateNotification.Tests.ps1`

Known limitation / follow-up:
- if Nova needs `preview*` and `beta*` to follow a custom release-channel order rather than raw SemVer prerelease ordering, that should be handled in a separate follow-up change.

Important

Do not use a public pull request to disclose a vulnerability before coordinated handling.
Use the private reporting path in SECURITY.md for new security issues.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codescene-delta-analysis]

Gates Passed
6 Quality Gates Passed

See analysis details in CodeScene

Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.