> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/integrations/github/github-action.md).

# The Seal GitHub Action

The Seal GitHub Action is, fundamentally, a wrapper around the Seal CLI for use inside a GitHub Actions workflow. It downloads the Seal CLI binary, sets the standard CLI environment (`SEAL_TOKEN`, `SEAL_PROJECT`, etc.) from the Action's inputs, and runs `seal scan` or `seal fix` against a target manifest in the runner's checkout. Everything the CLI does, the Action does; the Action just makes the CLI ergonomic for the Actions runtime.

Reference: `seal-community/cli-action`.

## Inputs

| Input       | Default              | Description                                                                                                          |
| ----------- | -------------------- | -------------------------------------------------------------------------------------------------------------------- |
| `version`   | latest               | The Seal CLI version to use, matching a release tag (for example, `v0.42.0`). Leave empty to use the latest release. |
| `target`    | `./requirements.txt` | Path to the manifest file declaring the dependencies (`package-lock.json`, `pom.xml`, `requirements.txt`, etc.).     |
| `mode`      | `scan`               | `scan` or `fix`. `scan` discovers and reports; `fix` substitutes.                                                    |
| `fix_mode`  | `local`              | When `mode: fix`, the CLI fix mode: `local`, `remote`, or `all`.                                                     |
| `verbosity` | `v`                  | CLI verbosity. One of `v`, `vv`, `vvv`.                                                                              |
| `summary`   | (empty)              | Path to write a summary file. Only relevant for `mode: fix`. Default: no summary file written.                       |
| `project`   | (empty)              | The Seal Project ID. Set via `SEAL_PROJECT` for the CLI. Required for fix mode.                                      |
| `token`     | (empty)              | The Seal token. Required for fix mode. Set this from a repository secret.                                            |

## Outputs

The Action does not set explicit outputs. The CLI's exit code propagates: non-zero fails the workflow step.

## Runner support

The Action is supported on Linux runners only.

## Example: scan

```yaml
- name: Seal scan
  uses: seal-community/cli-action@v1
  with:
    target: package-lock.json
    mode: scan
    token: ${{ secrets.SEAL_TOKEN }}
    project: my-project
```

## Example: remote-mode fix

```yaml
- name: Seal fix (remote mode)
  uses: seal-community/cli-action@v1
  with:
    target: package-lock.json
    mode: fix
    fix_mode: remote
    token: ${{ secrets.SEAL_TOKEN }}
    project: my-project
```

The Action invokes the CLI; the rest of the workflow (install dependencies, build, test) wraps around it as usual. Place the Seal step after the dependency-install step and before the build step, matching the CLI's timing rule.

## Versioning

The Action follows semver. Pin to a major version (`@v1`) for compatibility within a major release line, or pin to a specific tag (`@v1.4.2`) for fully reproducible builds. Use the matching `version:` input to pin the CLI binary version independently.

## Related

* [Integrating with GitHub Actions](/setup-apps-os/cli-in-cicd/github-actions.md): the setup how-to for using the Action in a workflow.
* [The CLI fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md): the fix modes the `fix_mode` input maps to.
* [The Seal GitHub App](/integrations/github/github-app.md): the unrelated GitHub App that handles source-side discovery and PR flows.