#175 fix: require explicit override for no-git bump fallback

[stiwicourage]

Stop nova bump and Update-NovaModuleVersion from silently presenting
Patch | Commits: 0 when Git-based bump inference is unavailable.

Add -OverrideWarning / --override-warning / -o as the explicit opt-in
for intentional non-git Patch fallback flows, add regression coverage, and
update bump docs and changelog.

Closes #175

Summary

• nova bump / Update-NovaModuleVersion now stop with a clear warning/error when Git-based bump inference is unavailable, instead of silently showing a normal-looking Patch | Commits: 0 result.
• Added an explicit opt-in fallback for real non-git scenarios: -OverrideWarning in PowerShell and --override-warning / -o in the CLI.
• Added regression coverage for the no-git and override flows, updated bump help/output docs, and recorded the change in CHANGELOG.md.
• This was needed because the old fallback hid inference failures and could produce the wrong version plan while looking legitimate.
• Closes [Bug]: nova bump should require explicit override when Git inference is unavailable #175

Affected area

• nova CLI or command routing
• Public PowerShell cmdlet behavior
• Scaffolding or project.json handling
• Build, test, analyzer, coverage, or CI helper flow
• Package, raw upload, or package metadata workflow
• Publish, release, or GitHub Actions automation
• Self-update or notification preference behavior
• Contributor documentation (README.md, CONTRIBUTING.md, repository workflow docs)
• End-user docs (docs/*.html)
• Command help (docs/NovaModuleTools/en-US/*.md)
• src/resources/example/
• Dependency or manifest changes (project.json, workflow dependencies, release tooling)
• Security-sensitive change
• Documentation-only change
• Other

Review guidance

• Start with the bump workflow guard in src/private/release/GetNovaVersionUpdateWorkflowContext.ps1 and the public entrypoint in src/public/UpdateNovaModuleVersion.ps1.
• Then review CLI routing in src/private/cli/ConvertFromNovaBumpCliArgument.ps1, src/private/cli/GetNovaCliArgumentRoutingState.ps1, and src/resources/cli/help/bump.psd1.
• Regression coverage is mainly in tests/NovaCommandModel.BumpAndCli.Tests.ps1, tests/CoverageGaps.ReleaseInternals.Tests.ps1, tests/NovaCommandModel.StandaloneCli.OverrideWarning.Tests.ps1, and tests/NovaCommandModel.StandaloneCli.Tests.ps1.
• Trade-off: intentional non-git bump flows now require explicit opt-in. That is the point of the fix, but existing automation that relied on the silent fallback must add -OverrideWarning / --override-warning / -o.

Validation

• Invoke-NovaBuild
• Test-NovaBuild
• ./scripts/build/Invoke-ScriptAnalyzerCI.ps1
• ./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1
• Targeted Nova workflow validated (% nova build, % nova test, % nova merge, % nova deploy,
  % nova publish,
  % nova release, % nova update, % nova notification, or % nova init as relevant)
• Docs/example only; executable validation not needed

Validation notes:

Ran the repo quality gate with:
pwsh -NoLogo -NoProfile -File ./run.ps1

Result:
PSScriptAnalyzer: no findings
Tests Passed: 674
Failed: 0

Also ran:
git --no-pager diff --check

Targeted bump behavior was covered through the automated cmdlet + standalone CLI regression tests for
Update-NovaModuleVersion / nova bump, including the new override-warning path.

Documentation and release follow-up

• README.md reviewed and updated if contributor workflow, architecture, CI, release, or automation changed
• CONTRIBUTING.md reviewed and updated if contribution expectations or review guidance changed
• CHANGELOG.md reviewed and updated if the change matters to users, maintainers, or contributors
• docs/NovaModuleTools/en-US/ help updated if a public command or CLI behavior changed
• docs/*.html updated if end-user workflows or examples changed
• src/resources/example/ reviewed and updated if the real-world project layout, package model, or upload workflow
  changed
• No documentation, changelog, or example updates were needed

Maintainability, compatibility, and risk

• Code Health / maintainability impact considered
• No breaking change
• Breaking change
• Security-sensitive change
• CI, workflow, or release-pipeline impact
• Dependency-review impact

Risk, rollout, or rollback notes:

Risk is low and localized to bump inference when Git history is unavailable.

Compatibility note:

• Intentional non-git bump workflows now need explicit opt-in with
  -OverrideWarning / --override-warning / -o.
• That is an intentional UX/safety tightening so Nova no longer hides inference failure behind a
  plausible Patch plan.

Rollback is straightforward:

• revert the bump guard + CLI option wiring if maintainers decide the fallback should remain implicit,
  though that would reintroduce the misleading Patch | Commits: 0 behavior.

[!IMPORTANT] Do not use a public pull request to disclose a vulnerability before coordinated handling. Use the private reporting path in SECURITY.md for new security issues.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codescene-delta-analysis]

Gates Passed
6 Quality Gates Passed

See analysis details in CodeScene

Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codescene-delta-analysis]

Code Coverage Gates Passed
Overall Coverage: 100.0% (required = 95%)
New & Changed Code Coverage: 100% (required = 99%)

Review details by gate

• Overall Coverage

  • Pass/Fail Reason:
    The overall coverage gate was checked for all code and meets the goal: 100.0% covered >= threshold = 95%
  • Action:
    You have 281 files with a sum of 2862 covered and 1 uncovered lines of code.

• New & Changed Code Coverage

  • Pass/Fail Reason:
    New or changed code meets coverage goal: 100% covered >= threshold = 99%
  • Action:
    You modified 4 files, and covered 13 added/modified lines of code.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!