JSS-Scripts is my fork of Balmes Pavlov's Jamf Pro scripts: deferrable macOS updates, upgrade nags, TCC resets, printer resets. Almost all of it is his work, and his repo has newer versions. Check there first.
I've added a setup guide anyway, because the process matters more than the scripts: nothing like this should reach a fleet without passing one test Mac first.
Check they parse, with the right shell
The README used to say "bash -n passes for every script". True, and a bit misleading: three of them are zsh. The check now reads each script's first line and uses that shell, and validates the LaunchDaemon as a real plist. It runs every week on a fresh Ubuntu machine.
It turned up two things worth knowing:
-
OS_Upgrade.shgets a here-document warning from bash 5 at line 786. It still parses, and macOS's own bash is 3.2, but I haven't run it on a Mac, so check the "quit all apps" step on yours. - The Homebrew script starts with a UTF-8 byte-order mark before
#!/bin/bash, which can stop macOS reading the shebang. Strip it before uploading.
Read the header, then upload
Every script lists its Jamf parameters, defaults and exit codes at the top. AppleSoftwareUpdate.sh, for example: $4 postponements (default 3), $5 dialog seconds (900), $6 contact, $7 icon. Exit 11 means no power, 13 FileVault still encrypting.
In Jamf Pro: Settings → Computer Management → Scripts → New, paste it, copy the parameter labels from the header. Then a policy scoped to one test Mac, run it with a custom trigger, and read the policy log. Try it with someone logged in and with nobody logged in.
What CI can't prove
Nearly everything. CI proves the files parse and the plist is valid. Nothing runs on a Mac or against Jamf, and these target macOS 10.12 to 10.15. Treat every one as untested until it's done the right thing on your test Mac.
Full guide: github.com/casareanderson/JSS-Scripts/blob/main/docs/SETUP.md
What's your process for testing a Jamf script before it hits the fleet?
🤖 Drafted with AI assistance from my own homelab notes, logs and repos, then reviewed and edited before publishing.
Top comments (0)