The CLI fix mode

The three modes the Seal CLI runs in, and which deployment method maps to which mode.

The Seal CLI's fix mode is what the CLI does when it runs against a Seal Project. The mode is set by the --mode flag on seal fix. There are three values:

Mode	What the CLI does	Deployment method
local	Reads Sealing Rules from a .seal-actions.yml file in the working directory, applies them, replaces matching packages with sealed versions.	Local
remote	Fetches Sealing Rules from the Seal Platform for the current Seal Project, applies them, replaces matching packages.	Remote
all	Skips the rule lookup entirely. For every vulnerable package the CLI discovers, it replaces it with the sealed version if one exists.	Automatic Remediation

The mode is the only thing that distinguishes the three CLI-in-CI deployment methods. The CLI itself, the token, the Seal Project, the network requirements, and the manifest scan are the same.

Choosing a mode

• Use remote when Sealing Rules are managed centrally through the Seal Platform UI by a security team.

• Use local when the Sealing Rules should live alongside the code they apply to, version-controlled with it, and reviewed in the same pull requests as code changes. The Seal GitHub App can open automatic pull requests that populate .seal-actions.yml for you.

• Use all when the team wants every vulnerable package replaced as a matter of policy, with no per-rule review. This produces the most replacements with the least operational effort, at the cost of the per-rule control the other two modes provide.

The recommended ordering for the three is in Choosing your deployment method.

What the mode controls

The fix mode determines which packages the CLI replaces on a given run. In remote mode, the CLI applies the remote Sealing Rules attached to the Seal Project; in local mode, the rules in .seal-actions.yml; in all mode, every vulnerable package that has a sealed version.

The Seal Project's current fix mode is visible on the Projects page, recorded from the most recent CLI run.

Switching modes is supported in any direction, but be aware that a run in the new mode no longer applies the rules from the previous one. Switching from remote to local makes your existing remote Sealing Rules effectively inert; switching from local to remote does the same for the rules in .seal-actions.yml. Pick a mode, recreate the rules in the new location if you change your mind, and stick with it. See Mode changes in Creating a Seal Project.

Related

• Choosing your deployment method: the decision page that places the three modes within the broader five-method picture.

• Sealing Rules: what local and remote modes apply, and how they are created.