GitHubAD: A Full-History Test Collection for Tracing Vulnerabilities to Their Fixing Commits

GitHubAD pairs 8,401 CVEs with the commits that fixed them, across 2,816 open-source repositories, and freezes the default-branch history of every repository. It is a test collection for patch tracing: given the description of a disclosed vulnerability, rank the commits of the affected repository so that a fixing commit comes first. This record holds the labels and subset files, the human label check, the per-CVE outputs of six archived runs, the Phase 1 shortlist, TREC qrels and run files, corpus audits, code, a loader and a scorer. The commit archives, vectors, keyword scores and every file that quotes commit text are in the Hugging Face dataset guanqun-yang/GitHubAD, revision tag v2.0.0. README.md explains how to combine the two parts, and SCHEMAS.md describes every file. Licenses: data under CC BY 4.0 and code under MIT; labels taken from PatchFinder keep GPL-3.0; commit content keeps the license of its repository (NOTICE.md).