v1.8.0

Results of reviewing every check that had no auto-fix. A fix was added only where the right rewrite can be worked out from the file itself and keeps the author's intent. Anything that needs a person to decide what was meant stays report-only. That covers block pairing, duplicate IDs, E400's hashes and everything in bes-relevance-lint. Each new fix was run over jgstew/bigfix-content (1,108 files) and a BigFix server export (2,987 files), every resulting diff was reviewed, and a second run changed nothing.

⚠️ Upgrade notes

• More files get rewritten, and fail the hook once. Auto-fix is on by default when files are given, which is how pre-commit runs hooks. Content that passed with only warnings on v1.7.0 can now be rewritten, for example a RUN verb, RunAs= or a HIGH severity. The hook exits 1 so the change is reviewed and re-staged. Pass args: ["--auto-fix", "no"] to report without rewriting.
• bes-actionscript-lint-schclass now changes files. Its new --auto-fix lowercases W302/W303. Before this release the hook never rewrote anything, and it exited 0 on warnings.
• W504 is retired (bes-actionscript-validate-script). dos is no longer reported. A leftover --disable W504 only prints the unknown-code notice.

Added: auto-fixes

bes-conventions-check

• E200: a missing ActionScript MIMEType is set to application/x-Fixlet-Windows-Shell, which every ActionScript hook already assumes. An allowed MIMEType in the wrong case is respelled. <ActionScript ...> text inside a CDATA body, such as relevance that generates BES XML, is never touched.
• E201: an unambiguous year-first SourceReleaseDate becomes YYYY-MM-DD: 2026-7-4, 2026/07/14, 2026.07.14 or 2026-07-14T10:20:30Z. A month-first or day-first date such as 07/14/2026 is never guessed at.
• E202 / E216: a timestamp that is only badly formatted is respelled. That covers zero-padding, capitalization, full month or day names, a GMT/UTC/UT/Z zone (becomes +0000) and a +HH:MM offset. A day-of-week that is wrong for the date is dropped, not recomputed; RFC 5322 makes it optional. An unparsable value is left alone.
• E209: a lowercase or mixed-case cve- prefix is uppercased. Several <CVENames> elements are not merged.
• E219: an evaluation period is zero-padded (6:5:0 → 06:05:00) when minutes and seconds are already below 60.
• W216: a SourceSeverity that differs from an allowed value only in case is respelled (HIGH → High). This also works with --severity-values.
• W220: DownloadSize is set to the prefetches' total, with the unzip utility left out. This happens only when the check can know the total.

bes-actionscript-validate-script

• E524: else if becomes elseif, unless the body has a stray endif (E501). A second endif means an if really was nested inside the else.
• W505: a waiting cmd.exe's /k becomes /c. A missing /c is inserted after cmd's own leading switches (/q, /d, /e:on, ...). Lines with /r or an unknown leading switch are left alone.
• E521: a bracketed but unquoted registry key is quoted: regset [HKEY_...\x] → regset "[HKEY_...\x]". A key with no brackets is left alone.

bes-actionscript-lint-schclass

• W302 / W303: new --auto-fix lowercases a non-lowercase command verb, or an override option keyword or value. It changes case only, and a {...} value is never touched. This is the hook's first auto-fix. Its scope is otherwise unchanged: the lexical grammar decides only which text is the verb.

bes-actionscript-validate-prefetch

• E403: two stray-text shapes have exactly one meaning each, and are fixed offline. sha2:/sha2= in front of a 64-hex value becomes sha256, and a space directly after the URL becomes %20. Stray text anywhere else is left for a human.

• http → https under --auto-fix-network (opt-in, the fix for bes-conventions-check's W207). An http:// prefetch URL is switched to https:// only after the https copy is proven to be the same file:

  1. A HEAD request must report a Content-Length equal to the line's size. This is checked before anything is downloaded, so a mismatch costs no download.
  2. The request must not redirect off https.
  3. The download is capped one byte past the expected size, and its size and every hash on the line (sha1 and/or sha256) must match.

  Only the URL's scheme changes. Each URL is checked at most once per run. In a live test on 28 real prefetches across 22 hosts, 12 were switched (software.bigfix.com, downloads.dell.com, support.bigfix.com, 7-zip.org, ...). The other 16 were left on http: 404s, dead hosts, TLS or certificate errors, and two newer files served under the same name that were caught by the size check without being downloaded.

Added: codes

• W407 (bes-actionscript-validate-prefetch): --auto-fix-network could not switch an http prefetch URL to https, and the line stays on http. The message says why: the host was unreachable, a redirect left https, the Content-Length differed, or the size or a hash differed. --disable W407 turns the https switch off.

Removed

• bes-actionscript-validate-script W504: it warned that dos was deprecated and suggested waithidden cmd.exe /c. The BigFix reference doesn't deprecate dos, and the suggested replacement behaves differently: dos shows its window and ends the action script when the command fails. The code will not be reused.

Fixed

• bes-relevance-lint W605 (an ActionScript substitution whose value is an opaque object with no text form) was reported but missing from the module docstring and the hook description. A new test now fails if any reported code is missing from the docstring, the hook description, or the README table.

Docs

• README, .pre-commit-hooks.yaml descriptions and module docstrings updated for every new fix, W407 and the W504 retirement. RELEASE_NOTES.md has new "auto-fix review" sections.

Full Changelog: v1.7.0...v1.8.0