Free · MIT · GitHub Action

Collect dated security-fix evidence from your GitHub history — then review it.

fixdossier is a free GitHub Action for evidence collection and review support, not a complete security-fix inventory. It reads releases, tags, published GitHub security advisories, merged Dependabot/Renovate PRs, and security-looking commits — then writes a dated fix record and a support-period policy you can check before you rely on it.

Get it on GitHub Release v0.1.0 Join the interest list

Use with uses: itulo/fixdossier@v0 · https://fixdossier.dev/

What it does

Three files that help you review what history shows

Runs on every release and weekly with the default GITHUB_TOKEN. Commits the files or uploads them as a build artifact. Output is starting evidence to review — silent fixes, keyword misses, and backport mapping errors still need a human pass. If a permission is missing, it notes the gap instead of failing.

SECURITY-RECORD.md

Dated fix log

Dated candidates mapped to a release when possible, with how each mapping was made, plus bot dependency updates — for review, not a guarantee of completeness.

security-record.json

Machine-readable

Same data as JSON (schema: fixdossier/v1) for tooling and audits.

SUPPORT.md

Support policy

Built from your inputs: support period in months, optional EOL date, security contact — with a “supported until” date per release.

Sources it reads

Releases and tags
Published GitHub security advisories (GHSA) for the repo
Merged Dependabot and Renovate PRs
Commits whose messages look like security fixes (CVE…, GHSA…, “security”, XSS/SSRF/RCE…)

Coverage

What the record covers — and what it does not

Advisory-derived rows use the advisory’s patched_versions matched to a release tag (shown as “advisory patched_versions”).
Heuristic-derived rows use the first stable release on or after the fix date (shown as “date heuristic”) — can be wrong for backports and multi-branch repos.
Unmatched / unreleased fixes stay listed when no release mapping is found (sample stats include an “Unreleased fixes” count).
Sources skipped for permissions (401/403/404 or rate limit) are noted as gaps in the record instead of failing the run.
Numeric confidence scores are not in the Action yet (roadmap). Today each row’s mapping method is the transparency signal — as in the sample table’s “How mapped” column.

Install

Drop into a workflow

Copy from examples/workflow.yml. Artifact mode needs only contents: read; commit mode needs contents: write.

yaml

permissions:
  contents: write        # commit mode; artifact mode: contents: read
  pull-requests: read
steps:
  - uses: actions/checkout@v4
  - uses: itulo/fixdossier@v0
    with:
      support_period_months: 24
      eol_date: '2030-12-31'
      contact: security@example.com
      mode: commit                    # artifact (default) | commit | none

Sample output

Real run against axios/axios

Generated 12 Oct 2026 from the public GitHub API. Full examples for axios, fastify, and vite live in the examples/ folder.

Advisories

Security commits

Bot updates (9 flagged)

125

Releases

Unreleased fixes

Date	Type	IDs	Fix	Shipped in	How mapped
2026-09-16	advisory	GHSA-j8rh-479h-cp32	Header Injection via Inherited headers After Minimal Interceptor	v1.20.0	advisory patched_versions
2026-09-16	advisory	GHSA-m8m8-qj5v-23w3	Node HTTP adapter prototype-pollution gadget (socket hijack)	v1.20.0	advisory patched_versions
2026-09-16	advisory	GHSA-r4gj-5m52-g5wh	maxRedirects: 0 not enforced by fetch adapter (SSRF)	v1.20.0	advisory patched_versions
2026-05-24	commit	CVE-2026-42264	fix: guard socketPath with own() to prevent prototype pollution SSRF	v1.17.0	date heuristic

Excerpt only — first rows of SECURITY-RECORD.md. Mapping method (advisory vs date heuristic) is shown for every row; treat heuristic rows and keyword-only commits as candidates to verify.

SUPPORT.md excerpt (fastify/fastify)

Inputs: 24 months support, EOL 2030-12-31.

Release	Released	Security support until	Status
v5.12.5	2026-09-16	2028-09-16	supported
v5.12.4	2026-09-11	2028-09-11	supported
v5.12.2	2026-09-04	2028-09-04	supported
v5.12.1	2026-08-18	2028-08-18	supported

Why (context, not a promise)

Ordinary engineering hygiene that is useful under new EU rules

The EU Product Liability Directive Directive (EU) 2024/2853 treats software as a product for products placed on the market from 9 Dec 2026. Courts can order disclosure of relevant evidence (Art. 9); some presumptions apply if it isn’t produced (Art. 10). Official text: EUR-Lex ELI.
The Cyber Resilience Act Regulation (EU) 2024/2847 will expect manufacturers to state a support period and provide security updates (main obligations from Dec 2027). Official text: EUR-Lex ELI.
A dated, versioned evidence record and a published support policy can help in either setting — they are not a complete inventory or a certificate of compliance.

Interest list

Follow along — no paid pack on this page

The Action itself is free (MIT). If you want a heads-up when docs, templates, or an optional evidence-pack draft land, leave your email below. Nothing is charged; there is no price on this page yet.

Or email directly: italo.armenti@gmail.com

Not legal advice. fixdossier is an engineering tool for evidence collection and review support. It does not make any product “compliant” or “certified” with the PLD, the CRA, or anything else. It does not limit liability. The record is compiled automatically and is not a complete security-fix inventory — fixes with no keyword or advisory are missed, and release mapping can be wrong for backports — so review it. Talk to a lawyer about your situation.

fixdossier provides tooling and templates for information only. It creates no lawyer–client relationship.