> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lanesync.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> LaneSync product updates and release notes.

Product updates for LaneSync (formerly SDLC State).

<Update label="2026-07-08" description="Minimal-tier onboarding — automatic branch protection">
  ## Trusted Bootstrap (LaneSync Lite)

  * **Removed manual GitHub Actions step** — minimal-tier repos no longer require running **SDLC Setup (run once)** from the Actions tab
  * After you merge the bootstrap PR, LaneSync **automatically configures branch protection** using your PAT (stored encrypted for up to 1 hour, then wiped)
  * **Retry endpoint** — if automatic setup fails, use **Retry branch protection setup** in the setup wizard (`POST /api/repos/:repoId/configure-rulesets`)
</Update>

<Update label="2026-07-07" description="Performance — S3 + CloudFront static UI">
  ## CDN architecture (staging / lanesync.dev)

  * **UI static assets** served from a private **S3 + CloudFront OAC** origin with long-lived edge caching (`/assets/*` immutable, `index.html` no-cache)
  * **`/api/*`** routes to EC2 backend only (CachingDisabled — auth headers preserved)
  * **EC2 right-sized** to `t3.small`; host nginx is API-only with gzip, keepalive, and timeouts
  * **Deploy pipeline** builds UI and `s3 sync`s to the static bucket + CloudFront invalidation (`deploy-ui` job)

  ### GitHub environment vars (staging)

  | Variable                     | Purpose                                                            |
  | ---------------------------- | ------------------------------------------------------------------ |
  | `UI_STATIC_BUCKET`           | S3 bucket for UI static assets (e.g. `lanesync-staging-ui-static`) |
  | `CLOUDFRONT_DISTRIBUTION_ID` | Distribution ID for post-deploy invalidation                       |

  ### Frontend

  * Route-level **code splitting** (`React.lazy`) — initial bundle \~27 KB (was \~439 KB monolith)
  * Vendor chunk split (`react`, `react-router-dom`)
  * Non-blocking **Google Fonts** preload (`display=swap`)
</Update>

<Update label="2026-07-07" description="Public API security hardening">
  ## CI authentication (OIDC + API keys)

  * **GitHub Actions OIDC** — evidence upload and deploy gate now require `Authorization: Bearer` with a verified OIDC token (`audience=lanesync`)
  * **LaneSync API keys** — workspace admins can create scoped `lsk_*` keys in Settings for non-GitHub CI or fallback; hashed at rest
  * Tenant is derived from the verified token claim, not from unauthenticated body fields — prevents evidence spoofing

  ## Cross-tenant fixes

  * `GET /api/config/repo-warnings` now requires session auth and returns only the active workspace's repos
  * `GET /api/milestones/check` is tenant-scoped via CI auth (no global version lookup)

  ## Abuse and injection hardening

  * Rate limiting (`express-rate-limit`) and security headers (`helmet`) on public endpoints
  * Webhook payload capped at 1 MB before processing
  * Evidence report HTML served with sandbox CSP + attachment disposition (stored XSS mitigation)
  * Generic error messages on public routes (no internal detail leak)

  ## Bootstrapped CI templates

  All language CI templates updated with `id-token: write` permission and authenticated evidence upload curl.
</Update>

<Update label="2026-07" description="Trusted Bootstrap & Team features">
  ## Trusted Bootstrap

  * **Minimal GitHub App tier** (LaneSync Lite) — bootstrap via user PAT without `administration:write`
  * PAT-driven **`sdlc-bootstrap`** PR flow: review files → merge → `sdlc-setup.yml` → `COMPLETE`
  * **File integrity monitoring** for watched workflow files (`sdlc-enforce.yml`, `ci.yml`) — tampering opens a GitHub issue and flags the repo

  ## Team management

  * **HMAC-signed invite links** (7-day expiry) for workspace teammates
  * **Admin** and **member** roles — admins manage invites, roles, and billing

  ## Billing and Pro plan

  * **Free plan:** up to 3 managed repositories; HTTP 402 when limit exceeded
  * **Pro plan:** unlimited repositories — admin submits upgrade request, platform admin approves payment

  ## Branch Links

  * **Start Work** on milestone issues — creates feature branch + draft PR from the dashboard
  * **Cut Release Branch** — creates the release branch from the development branch when all issues are closed
</Update>

<Update label="2026-06-10" description="Documentation launch">
  ## Mintlify documentation site

  * New public documentation at `docs-site/` — Mintlify-powered docs matching Vercel/Cursor standards
  * SaaS-first onboarding path at [lanesync.dev](https://lanesync.dev)
  * Enterprise / self-hosted section for Docker Compose deployments
  * API Reference tab with OpenAPI spec

  ## Product naming

  LaneSync was formerly known as **SDLC State**. The product name in the UI and all customer-facing docs is now **LaneSync**.
</Update>

<Update label="2026-05" description="Quality tracking">
  ## Quality & feature tracking

  * JUnit report parsing and feature linking via `sdlc.yaml` patterns
  * Regression detection between releases
  * CSV, HTML, and XLSX quality report exports
  * Quality scorecards in dashboard
</Update>

<Update label="2026-04" description="Multi-tenant SaaS">
  ## Hosted SaaS

  * GitHub OAuth with workspace picker for multi-org users
  * PostgreSQL row-level security per GitHub organization
  * Project roll-ups for multi-repo releases
</Update>

<Update label="2026-03" description="Core platform">
  ## Release governance

  * Five-stage pipeline: PLANNING → DEVELOPMENT → TESTING → EVIDENCING → DEPLOYMENT → DEPLOYED
  * Three-layer enforcement: GitHub Rulesets, backend state machine, `SDLC Enforce` CI action
  * `sdlc.yaml` as single source of truth per repository
  * Zero-config GitHub App bootstrap with CI workflow templates
</Update>

## Stay updated

* Sign in to [lanesync.dev](https://lanesync.dev) for in-product announcements
* Contact **[support@lanesync.dev](mailto:support@lanesync.dev)** for release updates