> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/setup-apps-os/cli-in-cicd/github-actions.md).

# Integrating with GitHub Actions

Run Seal in your GitHub Actions workflow using the seal-community/cli-action.

For GitHub Actions, Seal publishes a dedicated action: [`seal-community/cli-action`](https://github.com/seal-community/cli-action). Add it as a step in your workflow and it installs the Seal CLI, authenticates, and runs the scan-and-fix pass for you.

The action is distinct from the [Seal GitHub App](/discovering/connecting-source-control/github.md): the App connects your repositories to the Seal Platform for SCM-side discovery and automatic pull requests; the Action runs the CLI inside your build. You can use both, one, or neither.

## Before you start

* A [token](/getting-started/tokens.md) stored as a GitHub Actions secret.
* A [Project ID](/getting-started/creating-a-seal-project.md#project-id-and-project-name) for the activity to attribute to. The first run with a new ID creates the Seal Project.

## The step

```yaml
- name: seal cli
  uses: seal-community/cli-action@latest
  with:
    mode: fix
    fix_mode: all
    token: ${{ secrets.SEAL_TOKEN }}
    project: my-project-id
    target: ./package-lock.json
```

Place the step after the dependency-install step (`npm ci`, `mvn install`, and so on) and before any step that packages or bundles those dependencies. See [What the CLI does in CI](/setup-apps-os/cli-in-cicd.md#when-in-the-pipeline-the-cli-runs).

## Inputs

| Input              | Description                                                                                            |
| ------------------ | ------------------------------------------------------------------------------------------------------ |
| `token`            | The Seal token, sourced from a secret.                                                                 |
| `project`          | The Seal Project's Project ID.                                                                         |
| `mode`             | `scan` or `fix`. Default: `scan`. Use `fix` to apply Sealing Rules and replace vulnerable packages.    |
| `fix_mode`         | `local`, `remote`, or `all`. The CLI's [fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md).         |
| `target`           | Path to the dependency manifest. Default: `./requirements.txt`. Override for other ecosystems.         |
| `version`          | The Seal CLI version. Default: latest.                                                                 |
| `verbosity`        | `v`, `vv`, or `vvv`. Default: `v`.                                                                     |
| `summary`          | Path to write a summary file when running in fix mode.                                                 |
| `verify_signature` | Verifies the downloaded CLI's signature before running it. Default: `true`. Only `false` turns it off. |

For matrix builds, each matrix leg should pass its own `target` and, where relevant, its own Seal Project ID. The action runs on every event type GitHub Actions supports, on Linux (x64 and Arm64), macOS (Apple Silicon and Intel) and Windows (x64) runners.

Before running the CLI, the action verifies its signature and fails the step if the check fails: with cosign on [Linux](/setup-apps-os/cli-in-cicd/installing-the-cli.md#verifying-the-linux-download) and [Windows](/setup-apps-os/cli-in-cicd/installing-the-cli.md#verifying-the-windows-download), and with Seal's Apple Developer ID and notarization on [macOS](/setup-apps-os/cli-in-cicd/installing-the-cli.md#verifying-the-macos-installer). Set `verify_signature: false` to skip the check.

## Related

* [Installing the Seal CLI](/setup-apps-os/cli-in-cicd/installing-the-cli.md): the manual install path the action automates, for non-Actions contexts.
* [The CLI fix mode](/setup-apps-os/cli-in-cicd/cli-fix-mode.md): the meaning of the `fix_mode` input.
* [The Seal GitHub App](/discovering/connecting-source-control/github.md): the SCM-side integration distinct from this action.