> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lanesync.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Update LaneSync Workflows

> Refresh LaneSync-managed GitHub Actions templates via a reviewable PR — without changing sdlc.yaml or branch protection.

After bootstrap completes, LaneSync ships improvements to its **managed workflow templates** (security pins, evidence upload, deploy stubs). **Update LaneSync Workflows** lets you pull those changes into an already configured repository through a normal GitHub PR — you review the diff before anything lands on your default branch.

## What it does

* Compares the **installed template revision** in LaneSync against the **current templates** shipped with the product
* Shows a banner on the repository view when an update is available or a PR is already open
* Opens a PR on branch `lanesync-workflow-update-{revision}` (distinct from the bootstrap branch `sdlc-bootstrap`)
* Replaces **only LaneSync-managed workflow files** — never `sdlc.yaml`, branch protection, rulesets, or bootstrap state
* Records the new revision when you merge the PR (GitHub webhook)

<Note>
  Example CI check names like `CI — Build & Test` appear in rendered templates when you use LaneSync's CI starter. If you brought your own CI, those names come from your `sdlc.yaml` gates — see [Add LaneSync to existing CI](/guides/add-lanesync-to-existing-ci).
</Note>

## When the banner appears

Open any **fully configured** repository (`COMPLETE` or `LEGACY`) in [lanesync.dev](https://lanesync.dev). The banner is hidden when templates are already current.

| Status             | Banner                                                |
| ------------------ | ----------------------------------------------------- |
| `UP_TO_DATE`       | Hidden — installed revision matches current templates |
| `UPDATE_AVAILABLE` | **Update LaneSync workflows** button                  |
| `PR_PENDING`       | Link to the open update PR on GitHub                  |

The banner lists **Managed files** — the exact paths LaneSync will replace in the PR. Read this list before merging.

## Which files are managed

LaneSync manages a **subset** of workflows based on how the repository was set up:

| File                                                                        | Included when                                                          |
| --------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| `.github/workflows/sdlc-enforce.yml`                                        | Always — posts the `SDLC Enforce` status check                         |
| `.github/workflows/ci.yml` (or language-specific CI template)               | Wizard chose **no existing CI** (`hasExistingCI: false`)               |
| `.github/workflows/deploy-dev.yml`, `deploy-staging.yml`, `deploy-prod.yml` | **No existing deployment workflows** and staging enabled in the wizard |

Managed files include a header comment:

```yaml theme={null}
# ── LaneSync-managed workflow ─────────────────────────────────────────────
# This file is owned by LaneSync. Future "Update workflows" PRs may replace
# custom edits you make here. Review the PR diff before merging.
```

<Warning>
  Custom edits inside managed files appear in the PR diff. LaneSync does **not** preserve them automatically — copy important changes elsewhere before merging.
</Warning>

### Repositories with existing CI or deploy

If you chose **Yes, I have CI** or **Yes, I have deployment** in the wizard, LaneSync skips the matching template files during bootstrap **and** during workflow updates.

For **LEGACY** repositories (adopted before the setup wizard), LaneSync also **auto-detects** ownership from live GitHub workflows:

1. Reads each workflow's `name:` field under `.github/workflows/`
2. Compares names to required checks in `sdlc.yaml` (live file when available)
3. If a required check runs from a **non-template** workflow path, that category is treated as externally owned

**Example:** Your development gate uses a workflow named `Unified CI — Build & Push` in `unified-ci.yml`, and testing adds `Deploy App to AWS (DB + Compose)` in `deploy-app-aws.yml`. Future update PRs refresh **`sdlc-enforce.yml` only** — your real CI and deploy pipelines are untouched.

<Tip>
  Check names in `sdlc.yaml` must match GitHub Actions workflow `name:` fields exactly. Mismatches affect stage blocking and ownership detection — see [Configure sdlc.yaml](/guides/configure-sdlc-yaml).
</Tip>

## Update flow

```mermaid theme={null}
sequenceDiagram
  participant You
  participant LaneSync
  participant GitHub
  You->>LaneSync: Open repo view
  LaneSync->>LaneSync: Compare installed vs current revision
  alt Update available
    You->>LaneSync: Update LaneSync workflows
    LaneSync->>GitHub: Create PR (lanesync-workflow-update-*)
    You->>GitHub: Review diff and merge
    GitHub->>LaneSync: pull_request closed (merged)
    LaneSync->>LaneSync: Record installed revision
  end
```

<Steps>
  <Step title="Open the repository">
    In [lanesync.dev](https://lanesync.dev), navigate to **Repositories** and open a repo with bootstrap state **`COMPLETE`** or **`LEGACY`**.
  </Step>

  <Step title="Start the update">
    When the blue banner appears, click **Update LaneSync workflows**.

    * **Full tier** (`workflows:write` on the GitHub App): LaneSync creates the PR with the App token.
    * **Minimal tier**: Paste a GitHub PAT with **Contents** and **Workflow** write access. The token is used once and **not stored**.
  </Step>

  <Step title="Review the PR on GitHub">
    Open the linked PR. Confirm only the listed managed files changed. Verify template updates (Action pin bumps, evidence steps, etc.) look correct for your org.

    If templates moved ahead while a PR was open, the banner may warn that a **stale pending PR** exists — merge or close it, then create a fresh update if needed.
  </Step>

  <Step title="Merge">
    Merge the PR like any other change. LaneSync finalizes the installed revision via webhook. The banner disappears when revisions match.

    Merging does **not** re-run bootstrap, change rulesets, or edit `sdlc.yaml`.
  </Step>
</Steps>

## Full tier vs minimal tier

<Tabs>
  <Tab title="Full tier">
    The GitHub App has `workflows:write`. LaneSync creates update PRs directly — same as zero-touch bootstrap.

    See [Install the GitHub App](/guides/install-github-app).
  </Tab>

  <Tab title="Minimal tier (Trusted Bootstrap)">
    The App lacks `workflows:write`. You supply a PAT with **Contents: Read and write** and **Actions: Read and write** (classic: `repo` + `workflow` scopes).

    Same PAT requirements as [Trusted Bootstrap](/guides/trusted-bootstrap) bootstrap PR creation.
  </Tab>
</Tabs>

## File integrity vs managed templates

**Integrity monitoring** (tamper detection) applies only to `.github/workflows/sdlc-enforce.yml`. Deleting or modifying that file triggers an integrity alert and a restore flow.

CI and deploy **starter templates** are managed for updates but **do not** trigger integrity breaches when you edit them — though those edits may be overwritten by the next update PR.

## API

Session-authenticated endpoints (same cookie as the dashboard):

| Method | Path                                         | Purpose                                                                                      |
| ------ | -------------------------------------------- | -------------------------------------------------------------------------------------------- |
| `GET`  | `/api/repos/{repoId}/workflow-update-status` | Current status, managed file list, pending PR metadata                                       |
| `POST` | `/api/repos/{repoId}/workflow-update-pr`     | Create or reuse an update PR. Body: `{ "pat": "ghp_…" }` when the App cannot write workflows |

See the [API Reference](/api-reference/introduction) OpenAPI spec for response schemas.

## Troubleshooting

<AccordionGroup>
  <Accordion title="No banner on a bootstrapped repo">
    Workflow updates require bootstrap state **`COMPLETE`** or **`LEGACY`**. Repos still in `NOT_STARTED` or mid-bootstrap must finish [Install the GitHub App](/guides/install-github-app) or [Trusted Bootstrap](/guides/trusted-bootstrap) first.
  </Accordion>

  <Accordion title="Update PR overwrote the wrong CI file">
    LaneSync thought the repo used its CI starter. Confirm `sdlc.yaml` required checks match your real workflow `name:` fields on non-template paths. Re-open the repo view — ownership flags reconcile from live GitHub on the next status check. Future PRs should list only the correct managed files.
  </Accordion>

  <Accordion title="Banner still shows after merge">
    Ensure the merged PR was the pending update PR LaneSync tracked (PR number must match). Webhook delivery must reach LaneSync — check GitHub App webhook deliveries for your installation. Refresh the repo view after a few seconds.
  </Accordion>

  <Accordion title="403 or requiresPat when creating PR">
    **Full tier:** Re-approve GitHub App permissions including **Workflows: Read and write**. **Minimal tier:** Regenerate a PAT with Contents + Workflow write scoped to the repository.
  </Accordion>
</AccordionGroup>

## Related

<CardGroup cols={2}>
  <Card title="Trusted Bootstrap" icon="shield-check" href="/guides/trusted-bootstrap">
    Initial setup on the minimal GitHub App tier.
  </Card>

  <Card title="Add LaneSync to existing CI" icon="code-branch" href="/guides/add-lanesync-to-existing-ci">
    Keep your pipeline; add evidence and gates manually.
  </Card>

  <Card title="Configure sdlc.yaml" icon="file-code" href="/guides/configure-sdlc-yaml">
    Stage gates and check names — updated separately from workflow templates.
  </Card>

  <Card title="Troubleshooting" icon="wrench" href="/reference/troubleshooting">
    Sync, rulesets, and deploy gate issues.
  </Card>
</CardGroup>