The Seal GitHub App

Reference for the Seal GitHub App, its capabilities, permissions, and behavior across the Seal Platform.

The Seal GitHub App is a standard GitHub App that customers install on their organization (or on a selected subset of repositories). Installing it gives the Seal Platform source-side visibility into the repositories you opt in, and unlocks two features that depend on that visibility: source-code package discovery and pull-request flows for the Local fix mode.

What the App does

• Discovers packages from your default branch. For each repository you opt in, Seal reads the manifest files (package.json, requirements.txt, pom.xml, etc.) on the default branch and discovers the third-party packages declared there. Discovered packages appear on the Protection page just as they would from a CLI-based discovery.

• Opens pull requests for .seal-actions.yml updates (Local fix mode only). For Seal Projects that use the Local fix mode, the App backs two PR flows:

  • On demand. From the Projects page, click the PR button next to the project. The App opens a pull request that edits .seal-actions.yml to add the relevant entry.

  • Automatic. When configured, the App opens a PR each time a new sealed iteration ships for a package the project pins. The PR updates the .seal-actions.yml entry to point at the new iteration. Review and merge in your normal flow.

  These flows are specific to Local mode because .seal-actions.yml is the Local-mode rule file. Remote and Automatic Remediation modes do not use .seal-actions.yml; the App's PR flows are not exercised by those modes.

• Skips archived repositories. Repositories archived in GitHub are excluded from scans. The App treats them as if they were not installed.

What the App does not do

• It does not write to your repository on its own. Every modification opens a pull request that you review and merge.

• It does not run your CI. The CLI step in your CI pipeline still does the actual sealing; the App is responsible for the source-side context and PR flows.

• It does not have any role in the GHAS integration. The GHAS integration uses a separate GitHub personal access token configured on the Seal CLI, not the App's installation token.

Permissions

The App requests the minimum set of permissions for the capabilities above. The standard installation flow lists the exact permissions at install time; review them there before clicking Install. Customers in source-restricted environments who do not want Seal to read source code at all can skip installing the App entirely and operate the platform through the CLI alone. See the DevOps audience guide for the privacy framing.

Where the App's capabilities show up in the UI

• The Projects page. The per-project PR button on a Seal Project row uses the App to open a .seal-actions.yml PR. Only visible on Local-mode Seal Projects.

• The Protection page. Packages discovered through the App appear on the Vulnerable packages tab with their normal row state.

• Seal Project setup. When you create a Seal Project from a GitHub repository, the App's installation state determines what discovery modes are offered.

Installing the App

The walk-through, including the install URL and the per-repository scope-selection screen, lives in Connecting GitHub. That chapter is the primary how-to; this reference page describes what the App does once installed.

Related

• Connecting GitHub: the install how-to.

• Working with Seal Apps under Local: the rhythm that consumes the PR flows.

• Connecting GitHub through the Seal Engineer: a separate installation path for the App that runs from inside the Seal Engineer's setup flow.

• The Seal GitHub Action: the unrelated Actions step for invoking the CLI from a workflow.