> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/setup-apps-os/cli-in-cicd/github-actions.md).

# Integrating with GitHub Actions

For GitHub Actions, Seal publishes a dedicated action: [`seal-community/cli-action`](https://github.com/seal-community/cli-action). Add it as a step in your workflow and it installs the Seal CLI, authenticates, and runs the scan-and-fix pass for you.

The action is distinct from the [Seal GitHub App](/discovering/connecting-source-control/github.md): the App connects your repositories to the Seal Platform for SCM-side discovery and automatic pull requests; the Action runs the CLI inside your build. You can use both, one, or neither.

## Before you start

* A [token](/getting-started/tokens.md) stored as a GitHub Actions secret.
* A [Project ID](/getting-started/creating-a-seal-project.md#project-id-and-project-name) for the activity to attribute to. The first run with a new ID creates the Seal Project.

## The step

```yaml
- uses: seal-community/cli-action@latest
  with:
    mode: fix
    fix_mode: all
    token: ${{ secrets.SEAL_TOKEN }}
    project: my-project-id
    target: ./package-lock.json
```

Place the step after the dependency-install step (`npm ci`, `mvn install`, and so on) and before any step that packages or bundles those dependencies. See [What the CLI does in CI](/setup-apps-os/cli-in-cicd.md#when-in-the-pipeline-the-cli-runs).

## Inputs

| Input       | Description                                                                                         |
| ----------- | --------------------------------------------------------------------------------------------------- |
| `token`     | The Seal token, sourced from a secret.                                                              |
| `project`   | The Seal Project's Project ID.                                                                      |
| `mode`      | `scan` or `fix`. Default: `scan`. Use `fix` to apply Sealing Rules and replace vulnerable packages. |
| `fix_mode`  | `local`, `remote`, or `all`. The CLI's [fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md).      |
| `target`    | Path to the dependency manifest. Default: `./requirements.txt`. Override for other ecosystems.      |
| `version`   | The Seal CLI version. Default: latest.                                                              |
| `verbosity` | `v`, `vv`, or `vvv`. Default: `v`.                                                                  |
| `summary`   | Path to write a summary file when running in fix mode.                                              |

For matrix builds, each matrix leg should pass its own `target` and, where relevant, its own Seal Project ID. The action runs on every event type GitHub Actions supports.

## Related

* [Installing the Seal CLI](/setup-apps-os/cli-in-cicd/installing-the-cli.md): the manual install path the action automates, for non-Actions contexts.
* [The CLI fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md): the meaning of the `fix_mode` input.
* [The Seal GitHub App](/discovering/connecting-source-control/github.md): the SCM-side integration distinct from this action.