GitHub Advanced Security (GHAS) integration

Synchronize Seal's remediation findings into GitHub Advanced Security via the Dependabot alerts API.

The Seal CLI calls the GitHub Dependabot alerts API after every seal fix run and dismisses the corresponding alerts on the target repository. Dependabot is the path GitHub exposes for managing the SCA alerts that appear under GHAS.

Before you start

• A GitHub personal access token (PAT) with the repo:security_events scope (read, write, and dismiss security alerts).

• The GitHub organization name and the repository name that owns the alerts.

• If you are running self-hosted GitHub Enterprise Server, the URL of your Dependabot endpoint.

Configuration

Set these in your CI environment:

SEAL_DEPENDABOT_URL=https://api.github.com
SEAL_DEPENDABOT_TOKEN=<github pat with repo:security_events>
SEAL_DEPENDABOT_OWNER=<github organization name>
SEAL_DEPENDABOT_REPO=<github repository name>

SEAL_DEPENDABOT_URL defaults to https://api.github.com if omitted. Override it to point at your GitHub Enterprise Server instance.

Or in .seal-config.yml at the project root:

dependabot:
  url: https://api.github.com
  token: <github pat with repo:security_events>
  owner: <github organization name>
  repo: <github repository name>

How alerts are dismissed

Dependabot creates a single alert for different vulnerable versions of the same package. If your project is affected by more than one vulnerable version of the same package (only possible in certain ecosystems), Seal dismisses the alert only when all of those vulnerable versions have been sealed.

Verify

After a seal fix run with the integration configured, open the targeted repository's Security > Dependabot alerts view. Alerts Seal dismissed should appear as dismissed with a Seal-attributed reason.

Related

• How CLI-driven sync works

• The Seal GitHub App: the source-control integration, separate from this scanner integration.