Integrating with GitHub Actions

Run Seal in your GitHub Actions workflow using the seal-community/cli-action.

For GitHub Actions, Seal publishes a dedicated action: seal-community/cli-action. Add it as a step in your workflow and it installs the Seal CLI, authenticates, and runs the scan-and-fix pass for you.

The action is distinct from the Seal GitHub App: the App connects your repositories to the Seal Platform for SCM-side discovery and automatic pull requests; the Action runs the CLI inside your build. You can use both, one, or neither.

Before you start

• A token stored as a GitHub Actions secret.

• A Project ID for the activity to attribute to. The first run with a new ID creates the Seal Project.

The step

- name: seal cli
  uses: seal-community/cli-action@latest
  with:
    mode: fix
    fix_mode: all
    token: ${{ secrets.SEAL_TOKEN }}
    project: my-project-id
    target: ./package-lock.json

Place the step after the dependency-install step (npm ci, mvn install, and so on) and before any step that packages or bundles those dependencies. See What the CLI does in CI.

Inputs

Input	Description
token	The Seal token, sourced from a secret.
project	The Seal Project's Project ID.
mode	scan or fix. Default: scan. Use fix to apply Sealing Rules and replace vulnerable packages.
fix_mode	local, remote, or all. The CLI's fix mode.
target	Path to the dependency manifest. Default: ./requirements.txt. Override for other ecosystems.
version	The Seal CLI version. Default: latest.
verbosity	v, vv, or vvv. Default: v.
summary	Path to write a summary file when running in fix mode.
verify_signature	Verifies the downloaded CLI against Seal's signing key before running it. Default: true. Only false turns it off.

For matrix builds, each matrix leg should pass its own target and, where relevant, its own Seal Project ID. The action runs on every event type GitHub Actions supports.

Before running the CLI, the action verifies its signature and fails the step if the check fails. CLI versions before v0.3.365 are not signed, so the check fails for them. To run one of them, set verify_signature: false.

Related

• Installing the Seal CLI: the manual install path the action automates, for non-Actions contexts.

• The CLI fix mode: the meaning of the fix_mode input.

• The Seal GitHub App: the SCM-side integration distinct from this action.