fix: modernize dependency scripts for current tool versions

[HeyItsGilbert]

Summary

Review of all 16 PSDepend/PSDependScripts/ handlers against modern best practices, prompted by #187. Fixes the Chocolatey 2.0 breakage plus seven other latent bugs found during the review, and extends the reviewer checklist to cover the blind spots that let #187 ship.

Chocolatey 2.0 compatibility (fixes #187)

• Remote version queries now use choco search — choco list stopped querying remote sources in Chocolatey 2.0 and rejects URL sources with the exact error reported in the issue.
• --local-only is version-gated via a new Get-ChocoVersion helper: passed on 1.x (where list queries remote by default), omitted on 2.x (where the flag was removed).
• Default source and bootstrap URL moved to community.chocolatey.org; fixed an undefined $scriptUrl in the bootstrap error path.
• Version checks use Test-VersionEquality / TryParse instead of raw string equality and [System.Version] casts that throw on prerelease versions.

Other script fixes

Script	Fix
GitHub.ps1	COM shell.application zip extraction replaced with Expand-Archive (module floor is PS 5.1); New-Item pipeline leak suppressed
PSGalleryNuget.ps1	Lexical string version comparison ("10.0.0" -le "9.0.0" is true as strings) replaced with typed SemVer/Version comparison
FileSystem.ps1	Operator-precedence bug silenced the missing-source error; documented Force/Mirror params were absent from the param block (binding error); -like action checks normalized to -contains
Task.ps1	Help documented Target but code only read Source, so documented usage silently ran zero tasks — both now honored
Git.ps1	Script continued invoking git after reporting git was not found
Command.ps1	Verbose output used the wrong loop variable; FailOnError documented
Npm.ps1	Dead $PackageListArguments removed; Join-Path instead of \ concat

Reviewer checklist additions

The existing checklist verified invocation mechanics but not whether the wrapped tool''s CLI contract was still valid — #187 passed every item. New items cover: external tool/endpoint currency (version-gating flags across tool majors), docs-vs-code field drift, secrets in process argv, and output-stream hygiene.

Test plan

• Full Pester suite: 425 passed / 0 failed / 2 pre-existing platform skips
• New regression tests for --local-only detection on Chocolatey 1.x vs 2.x
• PSModuleGallery choco contract tests updated for list/search split

🤖 Generated with Claude Code

[github-actions]

Test Results

    3 files     66 suites   1m 34s ⏱️
  957 tests   899 ✅ 58 💤 0 ❌
1 281 runs  1 213 ✅ 68 💤 0 ❌

Results for commit be83442.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

This PR modernizes multiple PSDepend/PSDependScripts/ dependency handlers to align with current external-tool CLI behavior (notably Chocolatey 2.x), fixes several latent script bugs, and updates tests + reviewer guidance to prevent similar regressions.

Changes:

• Update Chocolatey handler for v2.x compatibility (remote queries via search, version-gated --local-only, updated default endpoints).
• Fix/modernize several other handlers (Task Target vs Source, GitHub extraction, version comparisons, path handling, output hygiene).
• Update Pester coverage and extend the reviewer checklist to include external tool currency and output-stream hygiene checks.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
Tests/PSModuleGallery.Type.Tests.ps1	Updates Chocolatey-related integration assertions (list vs search) and adds CLI version-gating regression coverage.
Tests/Chocolatey.Type.Tests.ps1	Updates default Chocolatey feed expectation to community.chocolatey.org.
PSDepend/PSDependScripts/Task.ps1	Honors Target (with Source treated as an alias) when enumerating tasks to run.
PSDepend/PSDependScripts/PSGalleryNuget.ps1	Replaces string version comparisons with typed SemanticVersion/Version comparisons.
PSDepend/PSDependScripts/Npm.ps1	Uses Join-Path for cross-platform-safe target building and removes dead variable.
PSDepend/PSDependScripts/GitHub.ps1	Replaces COM zip extraction with Expand-Archive and suppresses New-Item pipeline output.
PSDepend/PSDependScripts/Git.ps1	Stops processing immediately after reporting missing git.
PSDepend/PSDependScripts/FileSystem.ps1	Adds missing parameters and corrects action checks (-contains/-notcontains).
PSDepend/PSDependScripts/Command.ps1	Fixes verbose logging to reference the correct loop variable; documents FailOnError.
PSDepend/PSDependScripts/Chocolatey.ps1	Implements Chocolatey 2.x compatibility changes and improves version handling (with remaining semver gap noted in comments).
docs/PSDependScripts-ReviewerChecklist.md	Adds reviewer checklist items around external CLI currency, output-stream hygiene, and docs-vs-code drift.

Comments suppressed due to low confidence (2)

PSDepend/PSDependScripts/Chocolatey.ps1:20

• ChocoInstallScriptUrl is a public parameter in the param block but it isn't documented in the comment-based help (.PARAMETER ...). This creates docs-vs-code drift and makes Get-Help incomplete.

    .PARAMETER Force
    If specified and the package is already installed, force the install again.

    .PARAMETER PSDependAction
    Test, or Install the package. Defaults to Install

    Test: Return true or false on whether the dependency is in place
    Install: Install the dependency

PSDepend/PSDependScripts/FileSystem.ps1:113

• -Force is now a top-level parameter (and documented in help) but it isn't used to change folder install behavior. As written, -Force has no effect for container sources, so users can't actually get the "overwrite the target" behavior described in the help.

        if ($PSDependAction -contains 'Install') {
            # TODO: Add non Windows equivalent...
            [string[]]$Arguments = "/XO"
            $Arguments += "/E"
            if ($Dependency.Parameters.Mirror -eq $True -or $Mirror) {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[HeyItsGilbert]

Addressed all review feedback in be83442:

• Chocolatey.ps1: fixed synopsis grammar and stale Chocolatey.org references, documented Dependency and ChocoInstallScriptUrl, and made the "have latest" comparison SemanticVersion-first so prereleases like 2.2.2-beta no longer fall through to a reinstall.
• FileSystem.ps1: error now names the specific missing $Source, and the documented Force switch is wired - it drops robocopy /XO so the target is overwritten even where its copy is newer.

Full suite: 425 passed / 0 failed.