Skip to main content
After bootstrap completes, LaneSync ships improvements to its managed workflow templates (security pins, evidence upload, deploy stubs). Update LaneSync Workflows lets you pull those changes into an already configured repository through a normal GitHub PR — you review the diff before anything lands on your default branch.

​
What it does

  • Compares the installed template revision in LaneSync against the current templates shipped with the product
  • Shows a banner on the repository view when an update is available or a PR is already open
  • Opens a PR on branch lanesync-workflow-update-{revision} (distinct from the bootstrap branch sdlc-bootstrap)
  • Replaces only LaneSync-managed workflow files — never sdlc.yaml, branch protection, rulesets, or bootstrap state
  • Records the new revision when you merge the PR (GitHub webhook)
Example CI check names like CI — Build & Test appear in rendered templates when you use LaneSync’s CI starter. If you brought your own CI, those names come from your sdlc.yaml gates — see Add LaneSync to existing CI.

​
When the banner appears

Open any fully configured repository (COMPLETE or LEGACY) in lanesync.dev. The banner is hidden when templates are already current. The banner lists Managed files — the exact paths LaneSync will replace in the PR. Read this list before merging.

​
Which files are managed

LaneSync manages a subset of workflows based on how the repository was set up: Managed files include a header comment:
Custom edits inside managed files appear in the PR diff. LaneSync does not preserve them automatically — copy important changes elsewhere before merging.

​
Repositories with existing CI or deploy

If you chose Yes, I have CI or Yes, I have deployment in the wizard, LaneSync skips the matching template files during bootstrap and during workflow updates. For LEGACY repositories (adopted before the setup wizard), LaneSync also auto-detects ownership from live GitHub workflows:
  1. Reads each workflow’s name: field under .github/workflows/
  2. Compares names to required checks in sdlc.yaml (live file when available)
  3. If a required check runs from a non-template workflow path, that category is treated as externally owned
Example: Your development gate uses a workflow named Unified CI — Build & Push in unified-ci.yml, and testing adds Deploy App to AWS (DB + Compose) in deploy-app-aws.yml. Future update PRs refresh sdlc-enforce.yml only — your real CI and deploy pipelines are untouched.
Check names in sdlc.yaml must match GitHub Actions workflow name: fields exactly. Mismatches affect stage blocking and ownership detection — see Configure sdlc.yaml.

​
Update flow

1

Open the repository

In lanesync.dev, navigate to Repositories and open a repo with bootstrap state COMPLETE or LEGACY.
2

Start the update

When the blue banner appears, click Update LaneSync workflows.
  • Full tier (workflows:write on the GitHub App): LaneSync creates the PR with the App token.
  • Minimal tier: Paste a GitHub PAT with Contents and Workflow write access. The token is used once and not stored.
3

Review the PR on GitHub

Open the linked PR. Confirm only the listed managed files changed. Verify template updates (Action pin bumps, evidence steps, etc.) look correct for your org.If templates moved ahead while a PR was open, the banner may warn that a stale pending PR exists — merge or close it, then create a fresh update if needed.
4

Merge

Merge the PR like any other change. LaneSync finalizes the installed revision via webhook. The banner disappears when revisions match.Merging does not re-run bootstrap, change rulesets, or edit sdlc.yaml.

​
Full tier vs minimal tier

The GitHub App has workflows:write. LaneSync creates update PRs directly — same as zero-touch bootstrap.See Install the GitHub App.

​
File integrity vs managed templates

Integrity monitoring (tamper detection) applies only to .github/workflows/sdlc-enforce.yml. Deleting or modifying that file triggers an integrity alert and a restore flow. CI and deploy starter templates are managed for updates but do not trigger integrity breaches when you edit them — though those edits may be overwritten by the next update PR.

​
API

Session-authenticated endpoints (same cookie as the dashboard): See the API Reference OpenAPI spec for response schemas.

​
Troubleshooting

Workflow updates require bootstrap state COMPLETE or LEGACY. Repos still in NOT_STARTED or mid-bootstrap must finish Install the GitHub App or Trusted Bootstrap first.
LaneSync thought the repo used its CI starter. Confirm sdlc.yaml required checks match your real workflow name: fields on non-template paths. Re-open the repo view — ownership flags reconcile from live GitHub on the next status check. Future PRs should list only the correct managed files.
Full tier: Re-approve GitHub App permissions including Workflows: Read and write. Minimal tier: Regenerate a PAT with Contents + Workflow write scoped to the repository.

Trusted Bootstrap

Initial setup on the minimal GitHub App tier.

Add LaneSync to existing CI

Keep your pipeline; add evidence and gates manually.

Configure sdlc.yaml

Stage gates and check names — updated separately from workflow templates.

Troubleshooting

Sync, rulesets, and deploy gate issues.