The .seal-actions.yml file

The schema of the .seal-actions.yml file the CLI reads in Local fix mode.

.seal-actions.yml is the per-repository file the Seal CLI reads when running in Local fix mode. It declares which packages to seal, to which sealed iterations, per Seal Project.

The file lives at the repository root by default. The --actions-file-path global flag overrides the location.

Generating the file

seal scan --generate-actions-file

The scan discovers the vulnerable packages in the project, queries the platform for the available sealed iterations, and writes a .seal-actions.yml with the safest available iteration as the substitute for each.

Schema

meta:
  schema-version: <string>
  created-on: <ISO 8601 datetime>
  cli-version: <string>

projects:
  <seal-project-id>:
    targets:
      - <path to scan target>
    manager:
      ecosystem: <ecosystem identifier>
      name: <package manager identifier>
      version: <package manager version>
      class: <manifest | os | files | image>   # optional, defaults to manifest
    overrides:
      <library-name>:
        <vulnerable-version>:
          use: <sealed-version>
          from: <renamed library name>   # optional

Field	Required	Description
meta.schema-version	yes	Version of the schema this file uses.
meta.created-on	yes	ISO 8601 timestamp (UTC) of when the file was generated.
meta.cli-version	yes	Version of the Seal CLI that generated the file.
projects	yes	Map keyed by Seal Project ID. Exactly one entry per file.
projects.<id>.targets	yes	List of paths the scan was run against (manifests, directories).
projects.<id>.manager.ecosystem	yes	The ecosystem (for example, node, python, java).
projects.<id>.manager.name	yes	The package manager (for example, yarn, pnpm, pip, maven).
projects.<id>.manager.version	no	The package manager version.
projects.<id>.manager.class	no	The kind of manager. Defaults to manifest.
projects.<id>.overrides	no	Map keyed by package name; each value is a map keyed by vulnerable version.
projects.<id>.overrides.<lib>.<ver>.use	yes (within an override)	The sealed version to substitute.
projects.<id>.overrides.<lib>.<ver>.from	no	Renamed library name to substitute from (used when the sealed version is renamed).

Example

meta:
  schema-version: "1"
  created-on: 2026-04-10T09:14:08Z
  cli-version: v1.5.0

projects:
  my-project-id:
    targets:
      - ./package.json
    manager:
      ecosystem: node
      name: yarn
      version: "1.7"
    overrides:
      ejs:
        2.7.4:
          use: 2.7.4-sp1
          from: seal-ejs

Validation

The CLI validates the file at the start of every seal fix --mode local run. A malformed file fails the run with a printable error.

Editing the file

Three paths produce an updated .seal-actions.yml:

• seal scan --generate-actions-file regenerates the file from a fresh scan.

• seal add <package> <version> adds an override for one package without rewriting the rest.

• The Seal GitHub App can open pull requests that update the file.

For the day-2 rhythm around editing this file, see Working with Seal Apps under Local.

Related

• Working with Seal Apps under Local

• The CLI fix mode