Skip to main content
Trusted Bootstrap is the setup path for the minimal GitHub App tier (LaneSync Lite). Your organization keeps tight control: the App never receives administration:write or workflows:write, and you merge bootstrap changes yourself using a Personal Access Token (PAT).

​
When Trusted Bootstrap is used

Trusted Bootstrap applies when:
  • You installed the minimal tier GitHub App (administration:read only — no ruleset auto-creation by the App)
  • Your org policy blocks Apps from writing workflow files or branch protection settings
  • Zero-touch bootstrap is unavailable (for example, the full tier App lacks required permissions)
The App creates workflows and rulesets directly. If GitHub blocks automatic merging, review and merge the setup PR in LaneSync. Protection then completes using the App, without a PAT — see Install the GitHub App.

​
Before you start

  • LaneSync GitHub App installed on the repository (Install the GitHub App)
  • Repo setup wizard completed through branches, language, CI checks, and approvals
  • A GitHub Personal Access Token with:
    • repo scope (classic PAT) or repository Contents: Read and write + Administration: Write (fine-grained PAT)
    • workflow scope (classic PAT) or Actions: Read and write (fine-grained PAT)
  • At least one commit on the repository (empty repos cannot bootstrap)
Generate a classic PAT at GitHub → Settings → Developer settings → Personal access tokens. Fine-grained tokens must explicitly include this repository.

​
Bootstrap flow

1

Complete the repo wizard

In lanesync.dev, open the repository setup wizard. Configure development branch, language, CI check names, staging toggle, and release model. Review your choices before applying setup.
2

Create the bootstrap PR

On the final Set up step, paste your PAT and click Apply setup & create PR.LaneSync calls POST /api/repos/:repoId/bootstrap-pr using your token and opens a PR from the sdlc-bootstrap branch. The PR includes:
  • sdlc.yaml at the repo root
  • .github/workflows/sdlc-enforce.yml — SDLC gate (always required)
  • .github/workflows/ci.yml (or a language-specific CI template) — evidence uploader
Your PAT is stored encrypted for up to 1 hour so LaneSync can configure branch protection after you merge. It is wiped after use.Bootstrap state moves to PR_CREATED.
3

Review and merge the PR

Open Review & merge setup PR from the wizard to review the files and merge in LaneSync when GitHub permits it. View in GitHub is also available. PAT-based setup does not auto-merge.When you are satisfied, merge the PR. LaneSync detects the merge through the webhook or pending-setup reconciliation, applies branch protection rulesets with your token, and marks the repository COMPLETE.
4

Wait for setup to complete

The setup wizard shows Configuring branch protection… while LaneSync applies rulesets. This usually completes within a few seconds — no GitHub Actions step is required.If setup stays pending, use Retry branch protection setup in the wizard. LaneSync can reuse the encrypted PAT while it remains available; supply a replacement if it expired or was cleared after a failed attempt. Check the reported permissions or GitHub plan limitation before retrying repeatedly. Disabled, missing and unverifiable protection have distinct statuses; a configuration file or merged PR alone does not mean the repository is ready.Routine status checks do not reactivate rulesets that you deliberately disabled.
SDLC Enforce is always a required check — it is LaneSync infrastructure, not something you add to sdlc.yaml. Your wizard-configured CI job names must match GitHub Actions job names exactly.

​
File integrity monitoring

LaneSync monitors integrity-watched workflow files on every push webhook. Today only the SDLC gate workflow is watched: CI and deploy starter templates are LaneSync-managed and can be refreshed via Update LaneSync Workflows, but edits to those files do not trigger integrity alerts. If a watched file is modified or deleted:
  1. LaneSync sets a file integrity flag on the repository
  2. A GitHub issue is opened in your repo (label: sdlc-integrity) naming the affected files and pusher
  3. Pipeline enforcement may stop working until files are restored
To restore: open the LaneSync dashboard for the repository and click Restore workflow files. LaneSync creates a new PR using your PAT — review and merge it to clear the integrity flag. Restoring a previously deleted watched file automatically clears the breach flag.
Do not delete sdlc-enforce.yml unless you intend to disable LaneSync enforcement. Tampering triggers an integrity alert, not silent degradation.

​
Troubleshooting

Regenerate your PAT with repo and workflow scopes. For fine-grained tokens, grant Contents and Actions write access to this repository only.
The development branch you entered in the wizard must exist on GitHub. Return to the Branches step and match GitHub’s default branch name.
Open the repo setup wizard and click Retry branch protection setup. Ensure your PAT has repo + Administration (write) access (classic) or Contents + Actions + Administration (fine-grained). LaneSync retains the encrypted token for up to 1 hour — supply a replacement if needed. For App-based pending setup, retry uses the installed App and does not ask for a PAT.
Your workspace hit the free-plan repository limit. See Billing and plans to upgrade to Pro.
Review the current protection status and use the authorized setup configuration flow to restore missing protection. Routine status checks do not restore deliberately disabled rulesets. Contact support if protection cannot be restored.

Install the GitHub App

Full vs minimal tier permissions and installation steps.

Configure sdlc.yaml

Customize stage gates after bootstrap completes.

Update LaneSync Workflows

Refresh managed templates after bootstrap without re-running the wizard.