> ## Documentation Index > Fetch the complete documentation index at: https://docs.lanesync.dev/llms.txt > Use this file to discover all available pages before exploring further. # Add LaneSync to existing CI > Copy-paste OpenGrep SAST, Trivy CVE, coverage, test reports, and evidence upload into your own GitHub Actions workflow. Use this guide when your repository **already has CI** and you chose "Yes, I have one" in the setup wizard. LaneSync still adds `sdlc-enforce.yml` and branch protection; you add the blocks below to your existing pipeline. ## 1. Permissions ```yaml theme={null} permissions: id-token: write # GitHub OIDC for evidence upload contents: read ``` ## 2. Unit tests + coverage (language-specific) Run your existing test command, then emit a machine-readable report LaneSync can parse: | Language | Report format | Example | | --------- | ----------------- | ------------------------------------------------------------------------------------- | | Node/Jest | JSON | `jest --json --outputFile=jest-results.json --coverage --coverageReporters=cobertura` | | Python | JUnit XML | `pytest --junitxml=pytest-junit.xml --cov-report=xml:coverage/cobertura.xml` | | Go | JSON | `go test -json ./... > gotest.json` | | Java | Surefire + JaCoCo | Maven Surefire + `jacoco:report` | | C# | JUnit + Coverlet | `dotnet test --logger "junit;..." --collect:"XPlat Code Coverage"` | Tag tests with `feat_` in names so Quality Insights links them to features (see [Quality tracking](/concepts/quality-tracking)). ## 3. SAST (OpenGrep — free, no account) ```yaml theme={null} - name: SAST scan (OpenGrep) if: always() env: OPENGREP_VERSION: v1.22.0 OPENGREP_INSTALL_SHA: f458d7f0d52cc58eae1ca3cf3d5caf101e637519 run: | curl -fsSL "https://raw.githubusercontent.com/opengrep/opengrep/${OPENGREP_INSTALL_SHA}/install.sh" \ | bash -s -- -v "$OPENGREP_VERSION" || true export PATH="$HOME/.opengrep/cli/latest:$PATH" opengrep scan --config auto --sarif -o sast.sarif . 2>/dev/null || true COUNT=$(jq '[.runs[].results[]] | length' sast.sarif 2>/dev/null || echo 0) echo "

SAST (OpenGrep)

Findings: ${COUNT}

" > sast-scan-report.html ``` ## 4. CVE scan (Trivy) ```yaml theme={null} - name: CVE scan (Trivy) if: always() uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0 with: scan-type: fs scan-ref: . format: table output: trivy.txt exit-code: '0' severity: CRITICAL,HIGH - name: Render CVE report if: always() run: echo "

CVE (Trivy)

$(cat trivy.txt 2>/dev/null | head -200)

" > cve-scan.html ``` ## 5. Integration tests (optional) ```yaml theme={null} # ── Integration tests (uncomment and adapt) ── # - name: Run integration tests # run: npm run test:integration # # Write integration-tests.html or set integration_tests metrics in sdlc-evidence.json ``` ## 6. Upload evidence to LaneSync Runs on **dev**, **staging** (release branches), and **production** (release publish): ```yaml theme={null} - name: Upload evidence to LaneSync if: always() env: SDLC_API_URL: ${{ vars.SDLC_API_URL || 'https://lanesync.dev' }} run: | REF="${GITHUB_REF#refs/heads/}" if [ "$GITHUB_EVENT_NAME" = "release" ]; then ENVIRONMENT=production; VERSION="${GITHUB_REF#refs/tags/}" elif [ "$REF" = "main" ]; then ENVIRONMENT=dev; VERSION=dev elif case "$REF" in release/*) true;; *) false;; esac; then ENVIRONMENT=staging; VERSION="${REF#release/}" else exit 0 fi # Include test_report_files when you have a JUnit/JSON report — see ci-evidence-upload guide TOKEN=$(curl -s -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \ "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=lanesync" | jq -r .value) curl -s -X POST "$SDLC_API_URL/api/evidence/upload" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d @sdlc-evidence-payload.json ``` See [CI evidence upload](/guides/ci-evidence-upload) for the full payload shape, `test_report_files`, and OIDC details. **Optional:** Teams already running [SonarQube Community Edition](https://docs.sonarsource.com/sonarqube-community-build/) can add `sonarqube-scan-action` separately. LaneSync scorecards read coverage from Cobertura/lcov reports in your workflow, not from Sonar's dashboard.