> For the complete documentation index, see [llms.txt](https://docs.veedna.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veedna.com/unifai/scanning-for-violations/scanning-in-scms/path-a-cloud-hosted-scm-saas.md).

# Path A: Cloud-Hosted SCM (SaaS)

{% hint style="info" %}
The following setup instructions are specific to GitHub.
{% endhint %}

Use this path if your repositories are on GitHub.com or GitHub Enterprise Cloud. The scan runs on a GitHub-hosted runner and connects to the Lineaje SaaS MCP endpoint.

#### Before You Start

* A GitHub.com account, with permission to add repository or organization secrets and to enable GitHub Actions.
* A Lineaje PAT.

{% stepper %}
{% step %}

### Generate a Lineaje PAT

A Lineaje PAT authenticates the GitHub Action to Lineaje.

Follow these steps to generate a Lineaje PAT from your Lineaje account. The token grants the Action access to the Lineaje scan service:

1. Log in at app.veedna.com and navigate to **SBOM360** → **Integrations** → **Deploy Private Cloud** → **Personal Access Token**.
2. Click the link in the box.
3. Click **Generate Token**. A Lineaje login webpage opens.
4. Authenticate and click **Yes**. You are returned to the **Integrations** page.
5. Copy the **PAT** displayed on the Integrations page.
   {% endstep %}

{% step %}

### Add the Lineaje PAT to Your GitHub Repository or Organization

Store the Lineaje PAT as an encrypted secret so the GitHub Action can read it at runtime.

1. In GitHub, go to your repository (or organization) **Settings** → **Secrets and variables** → **Actions**.
2. Click New repository secret (or New organization secret). The secret form opens.
3. In the **Name** field, enter `LINEAJE_PAT_TOKEN`.
4. In the **Secret** field, paste the Lineaje PAT from Step 1. Click **Add secret**. The secret appears in the list, masked.

{% hint style="info" %}
To scan many repositories under one organization, add the token as an organization secret and grant access to the relevant repositories. Every repository then reuses the same `LINEAJE_PAT_TOKEN`.
{% endhint %}
{% endstep %}

{% step %}

### Create a New GitHub Repository

Create a new GitHub repository (for example, `Lineaje`) in the same organization as your other repositories.
{% endstep %}

{% step %}

### Optional: Accessing resources for multiple organizations

By default, the GitHub Actions workflow authenticates using `GITHUB_TOKEN`. To use a personal access token if the workflow requires access to resources across multiple organizations, create a token and replace `secrets.GITHUB_TOKEN` with your token name.
{% endstep %}

{% step %}

### Copy script to central repository

Download the following script and place it in the central repository under the **scripts** folder.

{% file src="/files/GngDKU3WZS3bZKAy1tvE" %}
{% endstep %}

{% step %}

### Copy GitHub Actions workflow file to central repository

Copy the below script and place it in a new file in the central repository under the “.github/workflows” folder. This file can be named “lineaje-unifai-scan.yaml”.

The `on:` events can be modified to trigger off new commits, new pull requests, etc. In the following example, the workflow is configured to run manually.

```yaml
name: Lineaje AI Scan
on:
  workflow_dispatch:
    inputs:
      source_repo:
        description: "Repository to scan (owner/repo)"
        required: true
      branch:
        description: "Branch to scan"
        required: true
        default: "main"
jobs:
  lineaje-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout target repo
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.inputs.source_repo }}
          ref: ${{ github.event.inputs.branch }}
          token: ${{ secrets.GITHUB_TOKEN }}
          path: target-repo
      - name: Checkout scanner scripts
        uses: actions/checkout@v4
        with:
          repository: ${{ github.repository }}
          path: .lineaje-scanner
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install dependencies
        run: pip install mcp
      - name: Run Lineaje AI policy scan with fix PR
        env:
          LINEAJE_PAT_TOKEN: ${{ secrets.LINEAJE_PAT_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TARGET_SHA=$(git -C target-repo rev-parse HEAD)
          python .lineaje-scanner/scripts/gha_repo_scan_fix.py \
            --source-path target-repo \
            --repo "${{ github.event.inputs.source_repo }}" \
            --branch "${{ github.event.inputs.branch }}" \
            --head-sha "$TARGET_SHA" \
            --create-fix-pr \
          | tee scan_result.txt
      - name: Publish scan result to job summary
        if: always()
        run: cat scan_result.txt >> $GITHUB_STEP_SUMMARY
```

{% endstep %}

{% step %}

### Run the GitHub Actions workflow

Run the GitHub Actions workflow and discover AI Assets using UnifAI. Based on the trigger setup, the workflow may be triggered automatically.
{% endstep %}
{% endstepper %}

## Set Up GitHub SaaS with GitHub Action

These steps set up a GitHub Actions workflow that authenticates to Lineaje, runs a UnifAI scan on your GitHub.com repository, and opens a remediation pull request with the fixes.

### Before You Start

* A GitHub.com repository
* A Lineaje Personal Access Token (PAT)
* Enable UnifAI policies 

### Setup

{% stepper %}
{% step %}

### Step 1: Obtain a Lineaje Personal Access Token (PAT)

The Lineaje PAT is obtained from the SBOM360 Integrations page:

* Log in at app.veedna.com and navigate to **SBOM360** → **Integrations** → **Deploy Private Cloud** → **Personal Access Token**.
* Click the link in the box.
* Click **Generate Token**. A Lineaje web page opens asking you to authenticate.
* Authenticate and click **Yes**. You are returned to the Integrations page.
* Copy the PAT displayed on the Integrations page.
  {% endstep %}

{% step %}

### Step 2: Setup Central Repository with Lineaje PAT 

* Create a new GitHub repository in the same organization as your other repositories.
* Follow <https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets> to add a new secret called `LINEAJE_PAT_TOKEN`.
  {% endstep %}

{% step %}

### Step 3: Copy Script to Central Repository

Download the following script and place it in the central repository under the "scripts" folder.

{% file src="/files/GngDKU3WZS3bZKAy1tvE" %}
{% endstep %}

{% step %}

### Step 4: Copy GitHub Actions Workflow File to Central Repository

Copy the below script and place it in a new file in the central repository under the ".github/workflows" folder. This file can be named "lineaje-ai-scan.yaml".

The `on` events can be modified to trigger off new commits, new pull requests etc.

In the below example, the workflow is configured to run manually.

{% code overflow="wrap" %}

```yaml
name: Lineaje AI Scan

on:
  workflow_dispatch:
    inputs:
      source_repo:
        description: "Repository to scan (owner/repo)"
        required: true
      branch:
        description: "Branch to scan"
        required: true
        default: "main"

jobs:
  lineaje-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout target repo
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.inputs.source_repo }}
          ref: ${{ github.event.inputs.branch }}
          token: ${{ secrets.GITHUB_TOKEN }}
          path: target-repo

      - name: Checkout scanner scripts
        uses: actions/checkout@v4
        with:
          repository: ${{ github.repository }}
          path: .lineaje-scanner

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: pip install mcp

      - name: Run Lineaje AI policy scan with fix PR
        env:
          LINEAJE_PAT_TOKEN: ${{ secrets.LINEAJE_PAT_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TARGET_SHA=$(git -C target-repo rev-parse HEAD)
          python .lineaje-scanner/scripts/gha_repo_scan_fix.py \
            --source-path target-repo \
            --repo "${{ github.event.inputs.source_repo }}" \
            --branch "${{ github.event.inputs.branch }}" \
            --head-sha "$TARGET_SHA" \
            --create-fix-pr \
            | tee scan_result.txt

      - name: Publish scan result to job summary
        if: always()
        run: cat scan_result.txt >> $GITHUB_STEP_SUMMARY
```

{% endcode %}
{% endstep %}

{% step %}

### Step 5: Run the GitHub Actions workflow.

Run the GitHub Actions workflow and discover AI Assets using UnifAI. Based on the trigger setup, the workflow may be triggered automatically.
{% endstep %}
{% endstepper %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.veedna.com/unifai/scanning-for-violations/scanning-in-scms/path-a-cloud-hosted-scm-saas.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.