> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/reference/cli/seal-actions-yml.md).

# The .seal-actions.yml file

`.seal-actions.yml` is the per-repository file the Seal CLI reads when running in Local fix mode. It declares which packages to seal, to which sealed iterations, per Seal Project.

The file lives at the repository root by default. The `--actions-file-path` global flag overrides the location.

## Generating the file

```bash
seal scan --generate-actions-file
```

The scan discovers the vulnerable packages in the project, queries the platform for the available sealed iterations, and writes a `.seal-actions.yml` with the safest available iteration as the substitute for each.

## Schema

```yaml
meta:
  schema-version: <string>
  created-on: <ISO 8601 datetime>
  cli-version: <string>

projects:
  <seal-project-id>:
    targets:
      - <path to scan target>
    manager:
      ecosystem: <ecosystem identifier>
      name: <package manager identifier>
      version: <package manager version>
      class: <manifest | os | files | image>   # optional, defaults to manifest
    overrides:
      <library-name>:
        <vulnerable-version>:
          use: <sealed-version>
          from: <renamed library name>   # optional
```

| Field                                      | Required                 | Description                                                                        |
| ------------------------------------------ | ------------------------ | ---------------------------------------------------------------------------------- |
| `meta.schema-version`                      | yes                      | Version of the schema this file uses.                                              |
| `meta.created-on`                          | yes                      | ISO 8601 timestamp (UTC) of when the file was generated.                           |
| `meta.cli-version`                         | yes                      | Version of the Seal CLI that generated the file.                                   |
| `projects`                                 | yes                      | Map keyed by Seal Project ID. Exactly one entry per file.                          |
| `projects.<id>.targets`                    | yes                      | List of paths the scan was run against (manifests, directories).                   |
| `projects.<id>.manager.ecosystem`          | yes                      | The ecosystem (for example, `node`, `python`, `java`).                             |
| `projects.<id>.manager.name`               | yes                      | The package manager (for example, `yarn`, `pnpm`, `pip`, `maven`).                 |
| `projects.<id>.manager.version`            | no                       | The package manager version.                                                       |
| `projects.<id>.manager.class`              | no                       | The kind of manager. Defaults to `manifest`.                                       |
| `projects.<id>.overrides`                  | no                       | Map keyed by package name; each value is a map keyed by vulnerable version.        |
| `projects.<id>.overrides.<lib>.<ver>.use`  | yes (within an override) | The sealed version to substitute.                                                  |
| `projects.<id>.overrides.<lib>.<ver>.from` | no                       | Renamed library name to substitute from (used when the sealed version is renamed). |

## Example

```yaml
meta:
  schema-version: "1"
  created-on: 2026-04-10T09:14:08Z
  cli-version: v1.5.0

projects:
  my-project-id:
    targets:
      - ./package.json
    manager:
      ecosystem: node
      name: yarn
      version: "1.7"
    overrides:
      ejs:
        2.7.4:
          use: 2.7.4-sp1
          from: seal-ejs
```

## Validation

The CLI validates the file at the start of every `seal fix --mode local` run. A malformed file fails the run with a printable error.

## Editing the file

Three paths produce an updated `.seal-actions.yml`:

* `seal scan --generate-actions-file` regenerates the file from a fresh scan.
* `seal add <package> <version>` adds an override for one package without rewriting the rest.
* The [Seal GitHub App](/integrations/github/github-app.md) can open pull requests that update the file.

For the day-2 rhythm around editing this file, see [Working with Seal Apps under Local](/using-platform/working-with-seal-apps/local.md).

## Related

* [Working with Seal Apps under Local](/using-platform/working-with-seal-apps/local.md)
* [The CLI fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md)