> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/github/github-action.md). # The Seal GitHub Action Reference for the Seal GitHub Action, a wrapper around the Seal CLI for use in GitHub Actions workflows. The Seal GitHub Action is, fundamentally, a wrapper around the Seal CLI for use inside a GitHub Actions workflow. It downloads the Seal CLI binary, sets the standard CLI environment (`SEAL_TOKEN`, `SEAL_PROJECT`, etc.) from the Action's inputs, and runs `seal scan` or `seal fix` against a target manifest in the runner's checkout. Everything the CLI does, the Action does; the Action just makes the CLI ergonomic for the Actions runtime. Reference: `seal-community/cli-action`. ## Inputs | Input | Default | Description | | ------------------ | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `version` | latest | The Seal CLI version to use, matching a release tag. Leave empty to use the latest release. | | `target` | `./requirements.txt` | Path to the manifest file declaring the dependencies (`package-lock.json`, `pom.xml`, `requirements.txt`, etc.). | | `mode` | `scan` | `scan` or `fix`. `scan` discovers and reports; `fix` substitutes. | | `fix_mode` | `local` | When `mode: fix`, the CLI fix mode: `local`, `remote`, or `all`. | | `verbosity` | `v` | CLI verbosity. One of `v`, `vv`, `vvv`. | | `summary` | (empty) | Path to write a summary file. Only relevant for `mode: fix`. Default: no summary file written. | | `project` | (empty) | The Seal Project ID. Set via `SEAL_PROJECT` for the CLI. Required for fix mode. | | `token` | (empty) | The Seal token. Required for fix mode. Set this from a repository secret. | | `verify_signature` | `true` | Verifies the downloaded CLI's signature before running it: cosign on Linux and Windows, Seal's Apple Developer ID and notarization on macOS. Only `false` turns it off. | ## Outputs The Action does not set explicit outputs. The CLI's exit code propagates: non-zero fails the workflow step. ## Signature verification Before it runs the CLI, the Action checks that Seal signed the download. If the check fails, the step fails and the CLI does not run. Set `verify_signature: false` to skip the check. | Runner | Check | | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Linux and Windows | The Action installs cosign and verifies the binary against Seal's signing key, which is built into the Action. See [Verifying the Linux download](/setup-apps-os/cli-in-cicd/installing-the-cli.md#verifying-the-linux-download) and [Verifying the Windows download](/setup-apps-os/cli-in-cicd/installing-the-cli.md#verifying-the-windows-download). | | macOS | The installer and the `seal` binary must be signed with Seal's Apple Developer ID (team `SNZS6SJMFA`), and the installer must be notarized by Apple. See [Verifying the macOS installer](/setup-apps-os/cli-in-cicd/installing-the-cli.md#verifying-the-macos-installer). | ## Runner support The Action runs on GitHub-hosted and self-hosted runners: * Linux x64 and Arm64 (for example `ubuntu-latest` and `ubuntu-24.04-arm`). * macOS on Apple Silicon and Intel (for example `macos-latest` and `macos-15-intel`). The Action unpacks the `.pkg` instead of installing it, so it needs no `sudo`. * Windows x64 (for example `windows-latest`). Self-hosted runners need `curl` or `wget` to download the CLI, and `unzip` on Linux and Windows. On Linux and Windows, the signature check also needs `curl` and `sha256sum` (or `shasum`) to install cosign. Self-hosted Windows runners also need [Git for Windows](https://gitforwindows.org), because the Action runs its steps in Bash. ## Example: scan ```yaml - name: Seal scan uses: seal-community/cli-action@latest with: target: package-lock.json mode: scan token: ${{ secrets.SEAL_TOKEN }} project: my-project ``` ## Example: remote-mode fix ```yaml - name: Seal fix (remote mode) uses: seal-community/cli-action@latest with: target: package-lock.json mode: fix fix_mode: remote token: ${{ secrets.SEAL_TOKEN }} project: my-project ``` The Action invokes the CLI; the rest of the workflow (install dependencies, build, test) wraps around it as usual. Place the Seal step after the dependency-install step and before the build step, matching the CLI's timing rule. ## Versioning Each release of the Action is tagged with its version, and `@latest` always points to the newest release. Pin to a version tag, or to a commit SHA, for reproducible builds. The `version` input pins the CLI binary separately from the Action. ## Related * [Integrating with GitHub Actions](/setup-apps-os/cli-in-cicd/github-actions.md): the setup how-to for using the Action in a workflow. * [The CLI fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md): the fix modes the `fix_mode` input maps to. * [The Seal GitHub App](/integrations/github/github-app.md): the unrelated GitHub App that handles source-side discovery and PR flows.