Skip to main content
Trusted Bootstrap is the setup path for the minimal GitHub App tier (LaneSync Lite). Your organization keeps tight control: the App never receives administration:write or workflows:write, and you merge bootstrap changes yourself using a Personal Access Token (PAT).

​
When Trusted Bootstrap is used

Trusted Bootstrap applies when:
  • You installed the minimal tier GitHub App (administration:read only — no ruleset auto-creation by the App)
  • Your org policy blocks Apps from writing workflow files or branch protection settings
  • Zero-touch bootstrap is unavailable (for example, the full tier App lacks required permissions)
The App creates workflows and rulesets directly. Bootstrap completes in one step — see Install the GitHub App.

​
Before you start

  • LaneSync GitHub App installed on the repository (Install the GitHub App)
  • Repo setup wizard completed through branches, language, CI checks, and approvals
  • A GitHub Personal Access Token with:
    • repo scope (classic PAT) or repository Contents: Read and write + Administration: Write (fine-grained PAT)
    • workflow scope (classic PAT) or Actions: Read and write (fine-grained PAT)
  • At least one commit on the repository (empty repos cannot bootstrap)
Generate a classic PAT at GitHub → Settings → Developer settings → Personal access tokens. Fine-grained tokens must explicitly include this repository.

​
Bootstrap flow

1

Complete the repo wizard

In lanesync.dev, open the repository setup wizard. Configure development branch, language, CI check names, staging toggle, and release model. LaneSync saves your choices before bootstrap begins.
2

Create the bootstrap PR

On the final Set up step, paste your PAT and click Create bootstrap PR.LaneSync calls POST /api/repos/:repoId/bootstrap-pr using your token and opens a PR from the sdlc-bootstrap branch. The PR includes:
  • sdlc.yaml at the repo root
  • .github/workflows/sdlc-enforce.yml — SDLC gate (always required)
  • .github/workflows/ci.yml (or a language-specific CI template) — evidence uploader
Your PAT is stored encrypted for up to 1 hour so LaneSync can configure branch protection after you merge. It is wiped after use.Bootstrap state moves to PR_CREATED.
3

Review and merge the PR

Open the PR link from the wizard or your GitHub pull requests list. Review every added file — nothing is auto-merged.When you are satisfied, merge the PR. LaneSync detects the merge via webhook, applies branch protection rulesets with your token, and marks the repository COMPLETE.
4

Wait for setup to complete

The setup wizard shows Configuring branch protection… while LaneSync applies rulesets. This usually completes within a few seconds — no GitHub Actions step is required.If setup stays pending, use Retry branch protection setup in the wizard and paste your PAT again.
SDLC Enforce is always a required check — it is LaneSync infrastructure, not something you add to sdlc.yaml. Your wizard-configured CI job names must match GitHub Actions job names exactly.

​
File integrity monitoring

LaneSync monitors watched workflow files (WATCHED_FILES) on every push webhook: If a watched file is modified or deleted:
  1. LaneSync sets a file integrity flag on the repository
  2. A GitHub issue is opened in your repo (label: sdlc-integrity) naming the affected files and pusher
  3. Pipeline enforcement may stop working until files are restored
To restore: open the LaneSync dashboard for the repository and click Restore workflow files. LaneSync creates a new PR using your PAT — review and merge it to clear the integrity flag. Restoring a previously deleted watched file automatically clears the breach flag.
Do not delete sdlc-enforce.yml or your CI evidence workflow unless you intend to disable LaneSync enforcement. Tampering triggers an integrity alert, not silent degradation.

​
Troubleshooting

Regenerate your PAT with repo and workflow scopes. For fine-grained tokens, grant Contents and Actions write access to this repository only.
The development branch you entered in the wizard must exist on GitHub. Return to the Branches step and match GitHub’s default branch name.
Open the repo setup wizard and click Retry branch protection setup. Ensure your PAT has repo + Administration (write) access (classic) or Contents + Actions + Administration (fine-grained). Tokens expire after 1 hour — generate a fresh one if needed.
Your workspace hit the free-plan repository limit. See Billing and plans to upgrade to Pro.
Use Retry branch protection setup in the setup wizard. On minimal tier, rulesets are created by LaneSync using your PAT — not by the App directly. Contact support if rulesets were deleted manually after setup.

Install the GitHub App

Full vs minimal tier permissions and installation steps.

Configure sdlc.yaml

Customize stage gates after bootstrap completes.