Cycode integration

Synchronize Seal's remediation findings into Cycode via .cycode/config.yaml policy-file edits. Local fix mode only.

Cycode reads ignore entries from a .cycode/config.yaml file in the repository. The Seal CLI writes entries to that file for the vulnerabilities Seal has sealed, and Cycode suppresses them on the next scan.

Like the Snyk and Grype policy-file integrations, the Cycode integration is meaningful only in Local fix mode, where the Seal CLI already writes into the repository checkout (.seal-actions.yml). In Remote or all mode the CLI does not modify your repository, so there is no natural place to land the policy-file edit.

Before you start

The Seal CLI step that drives the integration must have write access to the repository checkout in CI.

Enable policy-file generation

Invoke the Seal CLI with the explicit flags:

seal scan --generate-actions-file --generate-cycode-policy

The CLI generates or updates .cycode/config.yaml at the project root with CVE-exclusion entries for each vulnerability Seal sealed in this run.

The generated file follows the same format Cycode's own CLI writes via cycode ignore --by-cve … --scan-type sca.

Committing the file

.cycode/config.yaml is part of your repository. Commit it like any other source-controlled config. Cycode reads the version of the file present in the branch being scanned.

Verify

After a seal fix run with the integration configured, inspect the generated .cycode/config.yaml. The CVE-exclusion entries should match the vulnerabilities Seal sealed.

Related

• How CLI-driven sync works

• Snyk integration, Grype integration: the other policy-file-edit integrations.