v1.12.0

This release extends bes-schema-validate to Git External Custom Site files and BigFix Inventory signatures, and gives it a new, compact output format.

⚠️ Upgrade notes

• bes-schema-validate (and the deprecated validate-bes alias) now checks more files: siteConfig.xml, site.xml, digest.xml and Signatures/*.xml. These can fail where nothing was checked before.
• An Eclipse update-site site.xml will fail. Its plain <site> root matches Site.xsd (names match without regard to case). Add an exclude: for it (see the README). A .xml file whose root has no bundled schema, such as a sitemap or a Maven site.xml, is skipped.
• A repo-local .xsd is no longer used. If you relied on a Foo.xsd in the repo to validate a <Foo> root, that file now fails with "no schema".
• The output format changed. Anything that parses the hook's output needs updating (see below).

Added (bes-schema-validate)

• Git External Custom Site files (siteConfig.xml, site.xml, digest.xml) and BigFix Inventory signatures (Signatures/*.xml) are now validated against the schemas bundled with validate_bes_xml 2.4.0. The schema is picked by the root tag, apart from .ojo files, which always use BESOJO.xsd. The .xml names are matched case-sensitively, and only signatures directly inside a Signatures/ folder are matched. Set files: in your own config to change that.

Changed (bes-schema-validate)

• One path:line: message line per error (path: message when there is no line number), and nothing for files that pass. The name of every checked file and validate_bes_xml's verbose report are no longer printed. The exit code is still the number of failed files.
• Only the schemas bundled with validate_bes_xml are used, for .bes and .ojo files too. A repo-local copy of a bundled schema was already ignored, since the bundled one won the name clash.
• This now needs validate_bes_xml >= 2.4.1, < 3 (was >= 2.3.0). 2.4.0 bundles the site and signature schemas, and 2.4.1 maps .ojo/.BESDomain by file name only, not by the folders above it.

Full Changelog: v1.11.1...v1.12.0

v1.11.1

This release changes how the BES.xsd guard on auto-fix writes tells "no schema applies" apart from a real schema error.

⚠️ Upgrade notes

• An auto-fix can now be refused where it used to be written. Line-less failures, such as an unreadable file or a document with no root element, now count as schema errors. Before, they could be mistaken for "no schema applies", and the fix was written unchecked.

Changed

• This now needs validate_bes_xml >= 2.3.0, < 3 (was >= 2.2.1).
• The BES.xsd guard now uses validate_bes_xml's ValidationResult.status to decide that no schema applies, so validity is unknown and the fix is written. It used to guess from a missing schema plus errors with no line numbers, which also matched other line-less failures.
• A schema error with no line number now shows as just its message, not Line None: <message>, when the guard refuses an auto-fix.

Full Changelog: v1.11.0...v1.11.1

v1.11.0

This release changes only a dependency pin for bes-relevance-lint. There are no code changes.

Changed (bes-relevance-lint)

• This now needs bigfix-relevance-analyzer >= 1.23.1, < 2 (was >= 1.19.0), still only on Python 3.11 and newer.
• The new < 2 cap keeps a future major release of the analyzer, which may bring breaking changes, from being picked up without warning.

Full Changelog: v1.10.1...v1.11.0

v1.10.1

This release fixes how bes-actionscript-validate-script reads an escaped regex quantifier inside a {...} substitution.

⚠️ Upgrade notes

• E509 findings on lines with an escaped regex quantifier go away. If you added a skip marker or --disable E509 to get past them, you can remove it.
• E508 can now fire where it used to pass, on an unclosed substitution that contains an escaped quantifier. These lines already failed at runtime; the hook was missing them.

Fixed (bes-actionscript-validate-script)

• E509 false positive: an escaped regex quantifier such as {3}}, {1,3}} or {2,}} inside a {...} substitution is no longer misread. This is a regex "..." literal's {3} with its } written as the escape }}. The hook used to skip the quantifier first, which left the second } to close the substitution early, so every later } on the line was reported as stray. Outside a substitution, {3}} is handled as before.
• E508 is now reported for an unclosed substitution that contains an escaped quantifier, such as wait echo {(regex "a{3}}". The same misread used to close it early, so nothing was reported.

Full Changelog: v1.10.0...v1.10.1

v1.10.0

This release adds two errors to bes-actionscript-validate-script for parameter lines that fail at runtime. Both are auto-fixed.

⚠️ Upgrade notes

• bes-actionscript-validate-script can now fail where it used to pass, through the new E527 and E528 errors.
• With --auto-fix on (the default when files are given), the hook will now rewrite parameter lines. It quotes unquoted values and moves trailing comments onto their own line. Review the diff after the first run.
• To keep a specific line as-is, use the existing actionscript-parameter-ok marker, which now covers both codes. To turn a code off everywhere, use --disable E527 or --disable E528.

Added (bes-actionscript-validate-script)

• E527, a new error: a parameter "<name>" = <value> whose value is not double-quoted. The agent substitutes {...} first and then parses the line, so an unquoted value fails at runtime, even a singular one such as {"a"}. Auto-fixed by wrapping the value in quotes (" in an entity-escaped body). A value with a " outside {...}, or with %22, is reported but not fixed.
• E528, a new error: a trailing // comment on a parameter line. Only fixed-syntax lines (if/elseif/else/endif, the prefetch block, override) accept one, so the line fails at runtime even when its value is quoted. Auto-fixed by moving the comment onto its own line directly above. This fix runs before the E527 fix, so an unquoted value with a comment gets both fixes in one run.
• Both fixes are checked against BES.xsd before writing, like the other auto-fixes (E526).

Full Changelog: v1.9.3...v1.10.0

v1.9.3

This release updates bes-relevance-lint to bigfix-relevance-analyzer 1.19.0. That version adds five rules, and this release maps each of them to a code.

⚠️ Upgrade notes

• Requires bigfix-relevance-analyzer >= 1.19.0 on Python 3.11 or newer (was >= 1.16.3). The published hook installs it. If you define bes-relevance-lint as repo: local with language: python, raise the version in additional_dependencies.
• bes-relevance-lint can now fail where it used to pass, through the new E612 and E613 errors. Disable either with --disable if needed.
• Some E603 findings are now E611. A plural operand where the engine requires a single value used to be reported as a general type error. If your config passes --disable E603, these findings will now fail the hook as E611 until you also disable E611.

Added (bes-relevance-lint)

• E611, a new error: a plural operand where the engine requires a single value, which it refuses before evaluating anything. Where it is safe, a unique value of (or singular-aggregate) rewrite is printed as a suggested fix.
• E612, a new error: an ActionScript { with anything after it on its line and no } to close it there, which fails the action.
• E613, a new error: a <?Relevance with no closing ?>, so its relevance was never linted.
• E614, a new error, off by default: a BES file that is not well-formed XML. bes-schema-validate still owns file validity, so unparsable XML stays skipped here unless you pass --enable E614.
• W607, a new warning: a relevance code fence in markdown that is never closed. Only seen when you run the hook by hand on markdown.

Full Changelog: v1.9.2...v1.9.3

v1.9.2

This release updates bes-relevance-lint to bigfix-relevance-analyzer 1.16.3. That version adds two rules, moves plural ActionScript substitutions from an error to a warning, and reports a named file whose type the analyzer cannot read.

⚠️ Upgrade notes

• Requires bigfix-relevance-analyzer >= 1.16.3 on Python 3.11 or newer (was >= 1.13.3). The published hook installs it. If you define bes-relevance-lint as repo: local with language: python, raise the version in additional_dependencies.
• bes-relevance-lint can now fail where it used to pass, through the new E610. Disable it with --disable E610 if needed.
• A plural {...} substitution no longer fails the hook. It used to be the E608 error and is now the W606 warning, which fails only under --strict.

Added (bes-relevance-lint)

• E610, a new error: an ActionScript command word used as a relevance name, such as exists prefetch. Usually this is an ActionScript line pasted or doubled into relevance.
• W606, a new warning: an ordinary ActionScript {...} substitution (in a run, wait, parameter, ...) whose value may be more than one value. The client joins the values with no separator, so the action runs but probably not as meant. Use concatenation "<sep>" of (...) or a tighter filter.

Changed (bes-relevance-lint)

• E608 now covers a non-boolean <Relevance>, and an if/elseif/continue if condition that is not a boolean or string. Plural substitutions moved to W606.
• E607 now also reports a file named on the command line whose type the analyzer cannot read, such as notes.txt. Before, such a file passed with no output. Under pre-commit the hook's files: pattern keeps these files away, so this only matters if you run the hook by hand or widen files:.

Full Changelog: v1.9.0...v1.9.2

v1.9.0

This release adds a new hook, bes-relevance-convert-group, which rewrites a console-exported <GroupRelevance> into plain <Relevance>. It also adds a BES.xsd check to every hook that auto-fixes BES files. A fix that would make a schema-valid file invalid is no longer written.

⚠️ Upgrade notes

• Auto-fixing hooks can now fail with a new error where they used to fix and pass. This affects bes-conventions-check (E222), bes-actionscript-lint-schclass (E304), bes-actionscript-validate-prefetch (E404) and bes-actionscript-validate-script (E526). Each code means a fix pass was held back because it would have broken BES.xsd validity. Disabling the code (for example --disable E222) writes the fix anyway.
• Requires validate_bes_xml >= 2.2.1 (which brings lxml >= 5). The published hooks install it. If you run a hook script outside its hook environment and this package is missing, fixes are written unchecked, and a one-line warning on stderr says to install it.
• If you define these hooks as repo: local with language: python, add "validate_bes_xml>=2.2.1" to additional_dependencies.

Added

• bes-relevance-convert-group, a new hook. It rewrites each /BES/*/GroupRelevance (in a Fixlet, Task, Baseline, Analysis or FixletStream) in place:

  JoinByIntersection	components	becomes
  true	any	one <Relevance> per component
  false	one	<Relevance>s1</Relevance>
  false	two or more	<Relevance>(s1) OR (s2) OR ...</Relevance>

  • Each component's relevance is copied verbatim, and CDATA stays CDATA. An OR-join of several components is written once, as CDATA when any input was CDATA or the text needs escaping.
  • Everything outside the replaced block stays byte-identical, line endings included.
  • The hook converts by default and exits 1 when it changed something, so you can review the rewrite. --check is a dry run.
  • A missing JoinByIntersection still converts when there is only one component. With two or more components it is E702, because BES.xsd documents no default.
  • SearchComponentGroupReference (group membership) is not converted yet. Those files are reported as E701 and left unchanged.
  • Codes: E700 converted / needs converting, E701 group reference, E702 bad or missing JoinByIntersection, E703 no components or an empty Relevance, E704 the result would fail BES.xsd, W700 skipped.
  • A file opts out with <!-- pre-commit-skip: bes-relevance-convert-group -->.
  • Enable it with - id: bes-relevance-convert-group under this repo's hooks:.

Changed

• Every BES auto-fix write is checked against BES.xsd, one fix pass at a time. A pass that would turn a schema-valid file invalid is not written, and the other passes still are. For example, sha256 values downloaded for E401 are kept even when an unrelated fix is held back.
  • In bes-conventions-check, all the per-block fixes form one pass. In bes-actionscript-lint-schclass all the case fixes form one pass. In both, one bad fix holds back the rest of its pass.
  • A file that already fails validation is still fixed, since bes-schema-validate reports it either way.
  • Only the schemas bundled with validate_bes_xml are used, so a repo-local .xsd cannot stand in for BES.xsd. An .ojo file is checked against BESOJO.xsd and a .BESDomain file against BESDomain.xsd.
• Shared helpers moved into pre_commit_bigfix/bes_common.py. These are file reading and writing with line-ending preservation, .bes discovery, the report printer and the mustache-template pattern. Hooks behave the same as before.

Full Changelog: v1.8.4...v1.9.0

v1.8.4

bes-relevance-lint now prints a suggested fix for statements the analyzer can safely rewrite, and W602 covers more cases. Both come from moving to bigfix-relevance-analyzer 1.13.3. No other hook changed.

⚠️ Upgrade notes

• bes-relevance-lint needs bigfix-relevance-analyzer >= 1.13.3 (previously >= 1.12.4). As before, this applies only on Python 3.11+.
• Expect new W602 warnings. W602 used to flag only a whose filter written on a singular spelling. It now also flags an unfiltered singular in the middle of a chain when a plural is built from it, for example exists values of setting "x" of client. That statement errors when the setting is absent, while settings "x" answers False. Like any warning, these fail the hook only with --strict.

Added

• Suggested fixes in bes-relevance-lint output. When the analyzer can safely rewrite a whole statement (today, the singular spellings behind W602), the fixed statement is printed once, under that statement's first finding:

  task.bes:12: [W602] warning: ... (singular-spelling-mid-chain)
      suggested fix: exists values of settings "x" of client
  

  Files are not rewritten, and a suggestion does not change the exit status. A statement with several fixable findings still prints one suggestion.

Changed

• The W602 description is updated in the hook docstring, .pre-commit-hooks.yaml and the README codes table. The README and docstring now describe suggested fixes in place of "there is no auto-fix".

Full diff: v1.8.0...v1.8.4

v1.8.0

Results of reviewing every check that had no auto-fix. A fix was added only where the right rewrite can be worked out from the file itself and keeps the author's intent. Anything that needs a person to decide what was meant stays report-only. That covers block pairing, duplicate IDs, E400's hashes and everything in bes-relevance-lint. Each new fix was run over jgstew/bigfix-content (1,108 files) and a BigFix server export (2,987 files), every resulting diff was reviewed, and a second run changed nothing.

⚠️ Upgrade notes

• More files get rewritten, and fail the hook once. Auto-fix is on by default when files are given, which is how pre-commit runs hooks. Content that passed with only warnings on v1.7.0 can now be rewritten, for example a RUN verb, RunAs= or a HIGH severity. The hook exits 1 so the change is reviewed and re-staged. Pass args: ["--auto-fix", "no"] to report without rewriting.
• bes-actionscript-lint-schclass now changes files. Its new --auto-fix lowercases W302/W303. Before this release the hook never rewrote anything, and it exited 0 on warnings.
• W504 is retired (bes-actionscript-validate-script). dos is no longer reported. A leftover --disable W504 only prints the unknown-code notice.

Added: auto-fixes

bes-conventions-check

• E200: a missing ActionScript MIMEType is set to application/x-Fixlet-Windows-Shell, which every ActionScript hook already assumes. An allowed MIMEType in the wrong case is respelled. <ActionScript ...> text inside a CDATA body, such as relevance that generates BES XML, is never touched.
• E201: an unambiguous year-first SourceReleaseDate becomes YYYY-MM-DD: 2026-7-4, 2026/07/14, 2026.07.14 or 2026-07-14T10:20:30Z. A month-first or day-first date such as 07/14/2026 is never guessed at.
• E202 / E216: a timestamp that is only badly formatted is respelled. That covers zero-padding, capitalization, full month or day names, a GMT/UTC/UT/Z zone (becomes +0000) and a +HH:MM offset. A day-of-week that is wrong for the date is dropped, not recomputed; RFC 5322 makes it optional. An unparsable value is left alone.
• E209: a lowercase or mixed-case cve- prefix is uppercased. Several <CVENames> elements are not merged.
• E219: an evaluation period is zero-padded (6:5:0 → 06:05:00) when minutes and seconds are already below 60.
• W216: a SourceSeverity that differs from an allowed value only in case is respelled (HIGH → High). This also works with --severity-values.
• W220: DownloadSize is set to the prefetches' total, with the unzip utility left out. This happens only when the check can know the total.

bes-actionscript-validate-script

• E524: else if becomes elseif, unless the body has a stray endif (E501). A second endif means an if really was nested inside the else.
• W505: a waiting cmd.exe's /k becomes /c. A missing /c is inserted after cmd's own leading switches (/q, /d, /e:on, ...). Lines with /r or an unknown leading switch are left alone.
• E521: a bracketed but unquoted registry key is quoted: regset [HKEY_...\x] → regset "[HKEY_...\x]". A key with no brackets is left alone.

bes-actionscript-lint-schclass

• W302 / W303: new --auto-fix lowercases a non-lowercase command verb, or an override option keyword or value. It changes case only, and a {...} value is never touched. This is the hook's first auto-fix. Its scope is otherwise unchanged: the lexical grammar decides only which text is the verb.

bes-actionscript-validate-prefetch

• E403: two stray-text shapes have exactly one meaning each, and are fixed offline. sha2:/sha2= in front of a 64-hex value becomes sha256, and a space directly after the URL becomes %20. Stray text anywhere else is left for a human.

• http → https under --auto-fix-network (opt-in, the fix for bes-conventions-check's W207). An http:// prefetch URL is switched to https:// only after the https copy is proven to be the same file:

  1. A HEAD request must report a Content-Length equal to the line's size. This is checked before anything is downloaded, so a mismatch costs no download.
  2. The request must not redirect off https.
  3. The download is capped one byte past the expected size, and its size and every hash on the line (sha1 and/or sha256) must match.

  Only the URL's scheme changes. Each URL is checked at most once per run. In a live test on 28 real prefetches across 22 hosts, 12 were switched (software.bigfix.com, downloads.dell.com, support.bigfix.com, 7-zip.org, ...). The other 16 were left on http: 404s, dead hosts, TLS or certificate errors, and two newer files served under the same name that were caught by the size check without being downloaded.

Added: codes

• W407 (bes-actionscript-validate-prefetch): --auto-fix-network could not switch an http prefetch URL to https, and the line stays on http. The message says why: the host was unreachable, a redirect left https, the Content-Length differed, or the size or a hash differed. --disable W407 turns the https switch off.

Removed

• bes-actionscript-validate-script W504: it warned that dos was deprecated and suggested waithidden cmd.exe /c. The BigFix reference doesn't deprecate dos, and the suggested replacement behaves differently: dos shows its window and ends the action script when the command fails. The code will not be reused.

Fixed

• bes-relevance-lint W605 (an ActionScript substitution whose value is an opaque object with no text form) was reported but missing from the module docstring and the hook description. A new test now fails if any reported code is missing from the docstring, the hook description, or the README table.

Docs

• README, .pre-commit-hooks.yaml descriptions and module docstrings updated for every new fix, W407 and the W504 retirement. RELEASE_NOTES.md has new "auto-fix review" sections.

Full Changelog: v1.7.0...v1.8.0