Environment variables
Every environment variable the Seal CLI reads, with defaults.
All environment variables the Seal CLI reads use the prefix SEAL_. Each variable also has a YAML counterpart in .seal-config.yml; environment variables take precedence over YAML.
Core
SEAL_TOKEN
token
none
Authentication token to the Seal Artifact Server. Generated in the Seal UI.
SEAL_PROJECT
project
none
The Seal Project this run reports to.
SEAL_USE_GIT_BRANCH_FOR_PROJECT
use-git-branch-for-project
false
When true, each git branch reports to its own Seal Project. The CLI adds the current branch to the project ID (<project ID>_bran_<branch>), including a project ID you set with SEAL_PROJECT, and to the name of a new project (<name>-<branch>). Characters not allowed in a project ID are replaced or dropped (feature/x becomes feature-x), and the branch is shortened so the ID stays within 255 characters. On a detached HEAD, the usual CI checkout, the CLI reads the branch from the CI environment variables of GitHub Actions, GitLab, Jenkins, Azure Pipelines, Bitbucket and CircleCI. If no branch is found, the project ID does not change.
SEAL_USE_SEALED_NAMES
use-sealed-names
false
When true, sealed packages are installed under their seal--prefixed names. See Renamed packages.
SEAL_RENAME_IN_MANIFEST
rename-in-manifest
false
When true, the CLI also rewrites your project's own manifest to the sealed names: the root package.json and the dependency references in package-lock.json for npm, the root package.json and yarn.lock (Yarn Classic v1) for Yarn, and pom.xml for Maven. Requires use-sealed-names. See Renaming sealed packages.
Per-ecosystem
These are optional. They shape how the CLI interacts with each ecosystem's package manager.
npm
SEAL_NPM_PROD_ONLY
npm.prod-only
Only scan production dependencies.
SEAL_NPM_IGNORE_EXTRA
npm.ignore-extraneous
Ignore packages marked as extraneous.
pnpm
SEAL_PNPM_PROD_ONLY
pnpm.prod-only
Only scan production dependencies.
Maven
SEAL_MAVEN_PROD_ONLY
maven.prod-only
Only scan production dependencies.
SEAL_MAVEN_CACHE_PATH
maven.cache-path
Custom local Maven cache folder.
SEAL_MAVEN_RENAME_IN_POM
maven.rename-in-pom
Rename sealed packages in POM files. The Maven-only form of rename-in-manifest; both settings do the same thing for Maven.
SEAL_MAVEN_COPY_ENTIRE_M2_CACHE
maven.copy-entire-m2-cache
Copy the entire .m2 cache instead of only the project's dependencies.
SEAL_MAVEN_SKIP_DIRECTORY_CHANGES
maven.skip-directory-changes
Skip adding .seal markers in JAR directories.
SEAL_MAVEN_UPDATE_CLASS_METADATA
maven.update-class-metadata
Avoid false positives from scanners that fingerprint class files inside the JAR. Requires use-sealed-names.
Gradle
SEAL_GRADLE_PROD_ONLY
gradle.prod-only
Only scan production dependencies (the runtimeClasspath configuration). By default the CLI also scans compileClasspath and testRuntimeClasspath, so compile-only and test dependencies are included.
SEAL_GRADLE_HOME_PATH
gradle.home-path
Custom Gradle home for a private cache (must be absolute).
SEAL_GRADLE_COPY_ENTIRE_CACHE
gradle.copy-entire-cache
Link the entire Gradle cache instead of only the project's dependencies.
SEAL_GRADLE_SKIP_DIRECTORY_CHANGES
gradle.skip-directory-changes
Skip adding .seal markers in JAR directories.
SEAL_GRADLE_UPDATE_CLASS_METADATA
gradle.update-class-metadata
Avoid false positives from scanners that fingerprint class files inside the JAR. Requires use-sealed-names.
Java files
SEAL_JAVA_FILES_SKIP_DIRECTORY_CHANGES
java-files.skip-directory-changes
Skip adding .seal markers in JAR directories.
SEAL_JAVA_FILES_UPDATE_CLASS_METADATA
java-files.update-class-metadata
Avoid false positives from scanners that fingerprint class files inside the JAR. Requires use-sealed-names.
Python
SEAL_PYTHON_ONLY_BINARY
python.only-binary
Only install .whl artifacts, no source.
SEAL_PYTHON_DELETE_FROM_WHEEL_CACHE
python.delete-from-wheel-cache
Delete vulnerable wheels from the global pip cache after fix.
Composer (PHP)
SEAL_PHPCOMPOSER_PROD_ONLY
composer.prod-only
Only scan production dependencies.
Bundler (Ruby)
SEAL_BUNDLER_PROD_ONLY
bundler.prod-only
Only scan production dependencies.
RPM
SEAL_RPM_NO_GPG_INSTALL
rpm.no-gpg-install
Skip GPG signature verification during install.
Go
SEAL_GOLANG_DONT_CHANGE_GO_MOD
golang.dont-change-go-mod
Keep go.mod, vendor/, and modules.txt unchanged. The vendor folder is sealed; manifests retain origin versions.
Scanner integrations
Snyk
SEAL_SNYK_URL
snyk.url
https://api.snyk.io
Snyk API URL.
SEAL_SNYK_TOKEN
snyk.token
none
Snyk service-account token.
SEAL_SNYK_ORG_ID
snyk.org-id
none
Snyk organization ID.
SEAL_SNYK_PROJECT_ID
snyk.project-ids
none
Snyk project ID, or a comma-separated list.
Black Duck
SEAL_BLACKDUCK_URL
blackduck.url
Black Duck server URL.
SEAL_BLACKDUCK_TOKEN
blackduck.token
Black Duck access token.
SEAL_BLACKDUCK_PROJECT
blackduck.project-name
Black Duck project name.
SEAL_BLACKDUCK_PROJECT_VERSION_NAME
blackduck.project-version-name
Black Duck project-version name.
GHAS (Dependabot)
SEAL_DEPENDABOT_URL
dependabot.url
https://api.github.com
Dependabot endpoint URL.
SEAL_DEPENDABOT_TOKEN
dependabot.token
none
GitHub PAT with repo:security_events.
SEAL_DEPENDABOT_OWNER
dependabot.owner
none
GitHub organization name.
SEAL_DEPENDABOT_REPO
dependabot.repo
none
Repository name.
Ox Security
SEAL_OX_URL
ox.url
Ox API URL.
SEAL_OX_TOKEN
ox.token
Ox access token.
SEAL_OX_APPLICATION
ox.application
Ox application name.
SEAL_OX_EXCLUDE_WHEN_HIGH_CRITICAL_FIXED
ox.exclude-when-high-critical-fixed
Close the alert when every high- and critical-severity vulnerability is sealed.
Checkmarx
SEAL_CHECKMARX_URL
checkmarx.url
Checkmarx tenant URL.
SEAL_CHECKMARX_TOKEN
checkmarx.token
Checkmarx One API key. Mutually exclusive with the OAuth client settings.
SEAL_CHECKMARX_CLIENT_ID
checkmarx.client-id
Checkmarx OAuth client ID. Alternative to the API key.
SEAL_CHECKMARX_CLIENT_SECRET
checkmarx.client-secret
Checkmarx OAuth client secret.
SEAL_CHECKMARX_TENANT
checkmarx.tenant
Checkmarx tenant name. Required with the OAuth client; not used with the API key.
SEAL_CHECKMARX_PROJECT_ID
checkmarx.project-id
Checkmarx project ID.
SEAL_CHECKMARX_STATE
checkmarx.state
State applied to sealed vulnerabilities: a predefined Checkmarx state or a custom state name. Defaults to NotExploitable.
SentinelOne
SEAL_SENTINELONE_URL
sentinelone.url
SentinelOne tenant URL.
SEAL_SENTINELONE_TOKEN
sentinelone.token
SentinelOne API token.
SEAL_SENTINELONE_SCOPE_TYPE
sentinelone.scope-type
Scope type (for example, site, account).
SEAL_SENTINELONE_SCOPE_IDS
sentinelone.scope-ids
Comma-separated scope IDs.
SEAL_SENTINELONE_TAG
sentinelone.tag
Tag identifying the scanner policy to update.
Custom artifact server
Redirects sealed package downloads to a registry you control. Mutually exclusive with the JFrog Artifactory settings below. See Pulling sealed packages through your own registry.
SEAL_ARTIFACT_SERVER_BASE_URL
artifact-server-base-url
none
Base URL sealed packages are downloaded from, for every ecosystem. Must be an absolute http or https URL. Traffic to cli.sealsecurity.io and authorization.sealsecurity.io is unaffected, and the setting is not applied by seal image fix.
SEAL_ARTIFACT_SERVER_AUTHORIZATION_HEADER
artifact-server-authorization-header
none
Sent verbatim as the Authorization header to that server. Ignored when no base URL is set. Your Seal token is never sent to a configured artifact server.
JFrog Artifactory
SEAL_JFROG_ENABLED
jfrog.enabled
false
Route the CLI's traffic through JFrog.
SEAL_JFROG_AUTH_TOKEN
jfrog.token
none
JFrog reference token.
SEAL_JFROG_INSTANCE_HOST
jfrog.host
none
JFrog host (no scheme; for example, domain.jfrog.io).
SEAL_JFROG_INSTANCE_SCHEME
jfrog.scheme
https
URL scheme.
SEAL_JFROG_XRAY_ENABLED
jfrog.xray-enabled
false
Enable Xray integration.
SEAL_JFROG_REPOSITORY
jfrog.repository
none
JFrog repository name.
SEAL_JFROG_CLI_REPO
jfrog.cli-repo
seal-cli
Repo key for the CLI-backend remote.
SEAL_JFROG_MAVEN_REPO
jfrog.maven-repo
seal-mvn
Repo key for the Maven-artifacts remote.
Related
Last updated