#151 feat: default prerelease self-update confirmation to no

[stiwicourage]

Summary

• Changed prerelease self-update confirmation for Update-NovaModuleTool, Update-NovaModuleTools, and % nova update so the prerelease prompt now defaults to No instead of Yes.
• This was needed to make prerelease self-updates safer by preventing accidental updates when a user presses Enter before reading the prompt fully.
• Follow-up work: consider adding a CLI-facing integration test that exercises the full interactive % nova update prompt path end to end.

Affected area

• nova CLI or command routing
• Public PowerShell cmdlet behavior
• Scaffolding or project.json handling
• Build, test, analyzer, coverage, or CI helper flow
• Package, raw upload, or package metadata workflow
• Publish, release, or GitHub Actions automation
• Self-update or notification preference behavior
• Contributor documentation (README.md, CONTRIBUTING.md, repository workflow docs)
• End-user docs (docs/*.html)
• Command help (docs/NovaModuleTools/en-US/*.md)
• src/resources/example/
• Dependency or manifest changes (project.json, workflow dependencies, release tooling)
• Security-sensitive change
• Documentation-only change
• Other

Review guidance

• Start with src/private/update/ConfirmNovaPrereleaseModuleUpdate.ps1 and src/private/update/GetNovaPrereleaseModuleUpdateConfirmationPrompt.ps1.
• Main files changed:
• src/private/update/
• tests/UpdateNotification.Tests.ps1
• README.md
• docs/NovaModuleTools/en-US/
• docs/versioning-and-updates.html
• CHANGELOG.md
• Trade-off: this replaces the generic ShouldContinue prerelease confirmation with an explicit choice prompt so the default can be controlled. The behavior is safer, but it is now
  intentionally more conservative for prerelease self-update flows.

Validation

• Invoke-NovaBuild
• Test-NovaBuild
• ./scripts/build/Invoke-ScriptAnalyzerCI.ps1
• ./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1
• Targeted Nova workflow validated (% nova build, % nova test, % nova merge, % nova deploy,
  % nova publish,
  % nova release, % nova update, % nova notification, or % nova init as relevant)
• Docs/example only; executable validation not needed

Validation notes:

Invoke-NovaBuild
Invoke-Pester ./tests/UpdateNotification.Tests.ps1 -Output Detailed
./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1 -OutputDirectory ./artifacts

Focused validation covered the prerelease self-update prompt helper and the UpdateNotification test suite, including the nova update path through the shared self-update flow.
CodeScene pre-commit safeguard passed for the branch diff.

Documentation and release follow-up

• README.md reviewed and updated if contributor workflow, architecture, CI, release, or automation changed
• CONTRIBUTING.md reviewed and updated if contribution expectations or review guidance changed
• CHANGELOG.md reviewed and updated if the change matters to users, maintainers, or contributors
• docs/NovaModuleTools/en-US/ help updated if a public command or CLI behavior changed
• docs/*.html updated if end-user workflows or examples changed
• src/resources/example/ reviewed and updated if the real-world project layout, package model, or upload workflow
  changed
• No documentation, changelog, or example updates were needed

Maintainability, compatibility, and risk

• Code Health / maintainability impact considered
• No breaking change
• Breaking change
• Security-sensitive change
• CI, workflow, or release-pipeline impact
• Dependency-review impact

Risk, rollout, or rollback notes:

Compatibility impact is low: prerelease self-updates are still available, but they now require an explicit Y confirmation instead of accepting Enter as Yes.

Rollback is straightforward:

• restore Confirm-NovaPrereleaseModuleUpdate to use ShouldContinue
• remove the explicit choice/default metadata from the prerelease prompt helper
• revert the docs/changelog text that describes Enter as cancel

This does not change stable self-update behavior, package/release automation, or dependency handling.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codescene-delta-analysis]

Gates Passed
6 Quality Gates Passed

See analysis details in CodeScene

Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codescene-delta-analysis]

Code Coverage Gates Passed
Overall Coverage: 100.0% (required = 95%)
New & Changed Code Coverage: 100% (required = 100%)

Review details by gate

• Overall Coverage

  • Pass/Fail Reason:
    The overall coverage gate was checked for all code and meets the goal: 100.0% covered >= threshold = 95%
  • Action:
    You have 281 files with a sum of 2852 covered and 1 uncovered lines of code.

• New & Changed Code Coverage

  • Pass/Fail Reason:
    New or changed code meets coverage goal: 100% covered >= threshold = 100%
  • Action:
    You modified 2 files, and covered 5 added/modified lines of code.