Add LaneSync to existing CI

Use this guide when your repository already has CI and you chose “Yes, I have one” in the setup wizard. LaneSync still adds sdlc-enforce.yml and branch protection; you add the blocks below to your existing pipeline.

1. Permissions

permissions:
  id-token: write   # GitHub OIDC for evidence upload
  contents: read

2. Unit tests + coverage (language-specific)

Run your existing test command, then emit a machine-readable report LaneSync can parse:

Language	Report format	Example
Node/Jest	JSON	`jest --json --outputFile=jest-results.json --coverage --coverageReporters=cobertura`
Python	JUnit XML	`pytest --junitxml=pytest-junit.xml --cov-report=xml:coverage/cobertura.xml`
Go	JSON	`go test -json ./... > gotest.json`
Java	Surefire + JaCoCo	Maven Surefire + `jacoco:report`
C#	JUnit + Coverlet	`dotnet test --logger "junit;..." --collect:"XPlat Code Coverage"`

Tag tests with feat_<issue#> in names so Quality Insights links them to features (see Quality tracking).

3. SAST (OpenGrep — free, no account)

- name: SAST scan (OpenGrep)
  if: always()
  env:
    OPENGREP_VERSION: v1.22.0
    OPENGREP_INSTALL_SHA: f458d7f0d52cc58eae1ca3cf3d5caf101e637519
  run: |
    curl -fsSL "https://raw.githubusercontent.com/opengrep/opengrep/${OPENGREP_INSTALL_SHA}/install.sh" \
      | bash -s -- -v "$OPENGREP_VERSION" || true
    export PATH="$HOME/.opengrep/cli/latest:$PATH"
    opengrep scan --config auto --sarif -o sast.sarif . 2>/dev/null || true
    COUNT=$(jq '[.runs[].results[]] | length' sast.sarif 2>/dev/null || echo 0)
    echo "<html><body><h1>SAST (OpenGrep)</h1><p>Findings: ${COUNT}</p></body></html>" > sast-scan-report.html

4. CVE scan (Trivy)

- name: CVE scan (Trivy)
  if: always()
  uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0
  with:
    scan-type: fs
    scan-ref: .
    format: table
    output: trivy.txt
    exit-code: '0'
    severity: CRITICAL,HIGH

- name: Render CVE report
  if: always()
  run: echo "<html><body><h1>CVE (Trivy)</h1><pre>$(cat trivy.txt 2>/dev/null | head -200)</pre></body></html>" > cve-scan.html

5. Integration tests (optional)

# ── Integration tests (uncomment and adapt) ──
# - name: Run integration tests
#   run: npm run test:integration
#   # Write integration-tests.html or set integration_tests metrics in sdlc-evidence.json

6. Upload evidence to LaneSync

Runs on dev, staging (release branches), and production (release publish):

- name: Upload evidence to LaneSync
  if: always()
  env:
    SDLC_API_URL: ${{ vars.SDLC_API_URL || 'https://lanesync.dev' }}
  run: |
    REF="${GITHUB_REF#refs/heads/}"
    if [ "$GITHUB_EVENT_NAME" = "release" ]; then
      ENVIRONMENT=production; VERSION="${GITHUB_REF#refs/tags/}"
    elif [ "$REF" = "main" ]; then
      ENVIRONMENT=dev; VERSION=dev
    elif case "$REF" in release/*) true;; *) false;; esac; then
      ENVIRONMENT=staging; VERSION="${REF#release/}"
    else
      exit 0
    fi

    # Include test_report_files when you have a JUnit/JSON report — see ci-evidence-upload guide
    TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
      "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=lanesync" | jq -r .value)
    curl -s -X POST "$SDLC_API_URL/api/evidence/upload" \
      -H "Content-Type: application/json" \
      -H "Authorization: Bearer $TOKEN" \
      -d @sdlc-evidence-payload.json

See CI evidence upload for the full payload shape, test_report_files, and OIDC details.

Optional: Teams already running SonarQube Community Edition can add sonarqube-scan-action separately. LaneSync scorecards read coverage from Cobertura/lcov reports in your workflow, not from Sonar’s dashboard.

Get Started

Concepts

Guides

Dashboard

Reference

Enterprise

Add LaneSync to existing CI

1. Permissions

2. Unit tests + coverage (language-specific)

3. SAST (OpenGrep — free, no account)

4. CVE scan (Trivy)

5. Integration tests (optional)

6. Upload evidence to LaneSync

​1. Permissions

​2. Unit tests + coverage (language-specific)

​3. SAST (OpenGrep — free, no account)

​4. CVE scan (Trivy)

​5. Integration tests (optional)

​6. Upload evidence to LaneSync

1. Permissions

2. Unit tests + coverage (language-specific)

3. SAST (OpenGrep — free, no account)

4. CVE scan (Trivy)

5. Integration tests (optional)

6. Upload evidence to LaneSync