The Seal GitHub Action

Reference for the Seal GitHub Action, a wrapper around the Seal CLI for use in GitHub Actions workflows.

The Seal GitHub Action is, fundamentally, a wrapper around the Seal CLI for use inside a GitHub Actions workflow. It downloads the Seal CLI binary, sets the standard CLI environment (SEAL_TOKEN, SEAL_PROJECT, etc.) from the Action's inputs, and runs seal scan or seal fix against a target manifest in the runner's checkout. Everything the CLI does, the Action does; the Action just makes the CLI ergonomic for the Actions runtime.

Reference: seal-community/cli-action.

Inputs

Input	Default	Description
version	latest	The Seal CLI version to use, matching a release tag (for example, v0.42.0). Leave empty to use the latest release.
target	./requirements.txt	Path to the manifest file declaring the dependencies (package-lock.json, pom.xml, requirements.txt, etc.).
mode	scan	scan or fix. scan discovers and reports; fix substitutes.
fix_mode	local	When mode: fix, the CLI fix mode: local, remote, or all.
verbosity	v	CLI verbosity. One of v, vv, vvv.
summary	(empty)	Path to write a summary file. Only relevant for mode: fix. Default: no summary file written.
project	(empty)	The Seal Project ID. Set via SEAL_PROJECT for the CLI. Required for fix mode.
token	(empty)	The Seal token. Required for fix mode. Set this from a repository secret.

Outputs

The Action does not set explicit outputs. The CLI's exit code propagates: non-zero fails the workflow step.

Runner support

The Action is supported on Linux runners only.

Example: scan

- name: Seal scan
  uses: seal-community/cli-action@v1
  with:
    target: package-lock.json
    mode: scan
    token: ${{ secrets.SEAL_TOKEN }}
    project: my-project

Example: remote-mode fix

- name: Seal fix (remote mode)
  uses: seal-community/cli-action@v1
  with:
    target: package-lock.json
    mode: fix
    fix_mode: remote
    token: ${{ secrets.SEAL_TOKEN }}
    project: my-project

The Action invokes the CLI; the rest of the workflow (install dependencies, build, test) wraps around it as usual. Place the Seal step after the dependency-install step and before the build step, matching the CLI's timing rule.

Versioning

The Action follows semver. Pin to a major version (@v1) for compatibility within a major release line, or pin to a specific tag (@v1.4.2) for fully reproducible builds. Use the matching version: input to pin the CLI binary version independently.

Related

• Integrating with GitHub Actions: the setup how-to for using the Action in a workflow.

• The CLI fix mode: the fix modes the fix_mode input maps to.

• The Seal GitHub App: the unrelated GitHub App that handles source-side discovery and PR flows.