#263 feat: Enhance project.json support for Manifest.PrivateData

[stiwicourage]

Summary

• Prepared the release metadata review for the structured Manifest.PrivateData feature already staged in this branch.
• The release remains a prerelease and the current version string 3.3.2-preview is still the right SemVer target: this branch adds new public configuration capability without a breaking change, so the next stable line would be a minor release while the active develop-style working version stays on the preview suffix.
• The unreleased entries in CHANGELOG.md and RELEASE_NOTE.md already describe the final intended behavior clearly enough, so no further release-file edits were required in this pass.

Affected area

• nova CLI or command routing
• Public PowerShell cmdlet behavior
• Scaffolding or project.json handling
• Build, test, analyzer, coverage, or CI helper flow
• Package, raw upload, or package metadata workflow
• Publish, release, or GitHub Actions automation
• Self-update or notification preference behavior
• Contributor documentation (README.md, CONTRIBUTING.md, repository workflow docs)
• End-user docs (docs/*.html)
• Command help (docs/NovaModuleTools/en-US/*.md)
• src/resources/example/
• Dependency or manifest changes (project.json, workflow dependencies, release tooling)
• Security-sensitive change
• Documentation-only change
• Agentic Copilot Workflow + scaffold mirror + scaffold-sync guardrail test.
• Other

Review guidance

• Start with src/private/build/BuildManifest.ps1, src/private/build/UpdateManifestPrivateData.ps1, and src/private/build/ConvertToPowerShellDataLiteral.ps1 because that is the release-relevant workflow that turns project.json configuration into the generated manifest.
• The primary changed areas are src/private/build/, tests/private/build/, tests/public/TestNovaBuild.Integration.Tests.ps1, src/resources/Schema-Project.json, docs/schema/v3/project.json, docs/project-json-reference.html, CHANGELOG.md, and RELEASE_NOTE.md.
• Trade-off: Nova validates rewritten PrivateData manifests by re-importing the generated .psd1 because PowerShell's Test-ModuleManifest can reject valid consumer-defined top-level PrivateData; that limitation is now documented explicitly.

Validation

• Invoke-NovaBuild
• Invoke-NovaTest
• Test-NovaBuild
• ./scripts/build/Invoke-ScriptAnalyzerCI.ps1
• ./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1
• Targeted Nova workflow validated (% nova build, % nova test, % nova merge, % nova deploy, % nova publish, % nova release, % nova update, % nova notification, or % nova init as relevant)
• Docs/example only; executable validation not needed

Validation notes:

pwsh -NoLogo -NoProfile -File ./run.ps1
- PSScriptAnalyzer: no findings
- Main test run: 1241 passed, 0 failed, 4 skipped
- Build-validation run: 27 passed, 0 failed
- Measured coverage: 99.5% (target: 99%)

CodeScene
- ConvertToPowerShellDataLiteral.ps1: Code Health 10
- BuildManifest.ps1: Code Health 10
- pre_commit_code_health_safeguard: passed

Release-specific review
- Reviewed CHANGELOG.md, RELEASE_NOTE.md, project.json, README.md, CONTRIBUTING.md, .github/pull_request_template.md, and .github/workflows/Publish.yml
- Publish workflow version source still comes from Get-NovaProjectInfo -Version / project.json
- No release automation edits were required
- ./scripts/build/ci/Invoke-NovaModuleToolsCI.ps1 was not re-run in this pass

Documentation and release follow-up

• README.md reviewed and updated if contributor workflow, architecture, CI, release, or automation changed
• CONTRIBUTING.md reviewed and updated if contribution expectations or review guidance changed
• CHANGELOG.md reviewed and updated if the change matters to users, maintainers, or contributors
• RELEASE_NOTE.md reviewed and updated if the change affects public cmdlet usage, CLI usage, configuration semantics, or migration expectations
• docs/NovaModuleTools/en-US/ help updated if a public command or CLI behavior changed
• docs/*.html updated if end-user workflows or examples changed
• src/resources/example/ reviewed and updated if the real-world project layout, package model, or upload workflow changed
• No documentation, changelog, release-note, or example updates were needed

Maintainability, compatibility, and risk

• Code Health / maintainability impact considered
• No breaking change
• Breaking change
• Security-sensitive change
• CI, workflow, or release-pipeline impact
• Dependency-review impact

Risk, rollout, or rollback notes:

Current release posture: prerelease / preview.
Recommended version to carry forward in this branch: 3.3.2-preview.

Why:
- The change adds new project.json manifest capability without removing or breaking existing behavior.
- Existing projects without Manifest.PrivateData continue unchanged.
- The unreleased changelog/release-note entries already reflect the final intended behavior.

Known release caveat:
- Keep the unrelated untracked skill-mirror paths out of the final release-preparation commit.
- PowerShell's Test-ModuleManifest remains stricter than the valid data-file import path for consumer-defined top-level PrivateData; Nova now documents and works around that explicitly.

Important

Do not use a public pull request to disclose a vulnerability before coordinated handling.
Use the private reporting path in SECURITY.md for new security issues.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[codescene-access]

Gates Passed
6 Quality Gates Passed

See analysis details in CodeScene

Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codescene-access]

Code Coverage Gates Passed
Overall Coverage: 99.8% (required = 95%)
New & Changed Code Coverage: 100% (required = 99%)

Review details by gate

• Overall Coverage

  • Pass/Fail Reason:
    The overall coverage gate was checked for all code and meets the goal: 99.8% covered >= threshold = 95%
  • Action:
    You have 296 files with a sum of 4299 covered and 7 uncovered lines of code.

• New & Changed Code Coverage

  • Pass/Fail Reason:
    New or changed code meets coverage goal: 100% covered >= threshold = 99%
  • Action:
    You modified 3 files, and covered 150 added/modified lines of code.