fixdossier / Docs

fixdossier documentation

fixdossier is an MIT-licensed GitHub Action. It reads a repository's releases, tags, published GitHub security advisories, merged Dependabot and Renovate pull requests, and commit messages, and writes three files: SECURITY-RECORD.md, security-record.json (schema fixdossier/v1) and SUPPORT.md. Each fix row states how it was linked to a release, so you can see which rows need checking.

These pages document fixdossier 0.1.1 (the version in package.json on main), based on action.yml and src/core.js, with output from the examples/ folder (axios/axios, fastify/fastify, vitejs/vite).

Quick start

Save as .github/workflows/security-record.yml. Artifact mode is the default and needs only read permissions.

name: security-record
on:
  release:
    types: [published]
  schedule:
    - cron: '0 6 * * 1'   # weekly
  workflow_dispatch:
permissions:
  contents: read
  pull-requests: read
jobs:
  record:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: itulo/fixdossier@v0
        with:
          support_period_months: 24
          contact: security@example.com
          # mode: artifact is the default

To commit the files back to the branch instead, set mode: commit and grant contents: write. See Build a dated record of security fixes.

Pages

• Build a dated record of security fixes from GitHub history: what the Action reads, what it writes, how to run it in CI or locally.
• How a GitHub security advisory is mapped to a release: the three mapping methods, matched_releases, and what still needs a manual check.
• What the record covers and what it does not: advisory vs heuristic rows, unreleased fixes, permission gaps, max_pages.
• Generate SUPPORT.md with a support period: how support_period_months and eol_date turn into per-release dates, and what the CRA text says about support periods.
• PLD evidence checklist for engineers: practical steps for keeping dated, reviewable fix evidence.
• Sample security records: unedited output for public repositories, with how each row was mapped.

Inputs

From action.yml. Three further inputs (pro_upload, pro_url, pro_token) control the optional upload mentioned at the end of this page.

Outputs

Gaps are printed as workflow warnings (::warning title=fixdossier gap::...) and listed under “Gaps in this record”. The run still succeeds unless fail_on_gaps: 'true'. In commit mode a failed push is a warning, not a failure.

Requirements

• Runs as a composite action with Node on the runner (Node 20+, no npm dependencies). ubuntu-latest works.
• Permissions: contents: read and pull-requests: read; contents: write for commit mode. If you set a permissions: block, anything you leave out is not granted, so a missing pull-requests: read shows up as a gap for pull requests.

The Action works on its own; if you want a hosted review queue and signed exports, there is an optional paid service, fixdossier Pro (demo), at €69 one-time for a Founding Licence covering 1 GitHub org, up to 3 repos and 5 reviewers.

Docs pages

• Docs home
• Build the record
• Advisory → release mapping
• Coverage and limits
• SUPPORT.md and support periods
• PLD evidence checklist
• Sample records
• Source on GitHub (MIT)