Path A: Cloud-Hosted SCM (SaaS)

The following setup instructions are specific to GitHub.

Use this path if your repositories are on GitHub.com or GitHub Enterprise Cloud. The scan runs on a GitHub-hosted runner and connects to the Lineaje SaaS MCP endpoint.

Before You Start

• A GitHub.com account, with permission to add repository or organization secrets and to enable GitHub Actions.

• A Lineaje PAT.

1

Generate a Lineaje PAT

A Lineaje PAT authenticates the GitHub Action to Lineaje.

Follow these steps to generate a Lineaje PAT from your Lineaje account. The token grants the Action access to the Lineaje scan service:

1. Log in at app.veedna.com and navigate to SBOM360 → Integrations → Deploy Private Cloud → Personal Access Token.

2. Click the link in the box.

3. Click Generate Token. A Lineaje login webpage opens.

4. Authenticate and click Yes. You are returned to the Integrations page.

5. Copy the PAT displayed on the Integrations page.

2

Add the Lineaje PAT to Your GitHub Repository or Organization

Store the Lineaje PAT as an encrypted secret so the GitHub Action can read it at runtime.

1. In GitHub, go to your repository (or organization) Settings → Secrets and variables → Actions.

2. Click New repository secret (or New organization secret). The secret form opens.

3. In the Name field, enter LINEAJE_PAT_TOKEN.

4. In the Secret field, paste the Lineaje PAT from Step 1. Click Add secret. The secret appears in the list, masked.

To scan many repositories under one organization, add the token as an organization secret and grant access to the relevant repositories. Every repository then reuses the same LINEAJE_PAT_TOKEN.

3

Create a New GitHub Repository

Create a new GitHub repository (for example, Lineaje) in the same organization as your other repositories.

4

Optional: Accessing resources for multiple organizations

By default, the GitHub Actions workflow authenticates using GITHUB_TOKEN. To use a personal access token if the workflow requires access to resources across multiple organizations, create a token and replace secrets.GITHUB_TOKEN with your token name.

5

Copy script to central repository

Download the following script and place it in the central repository under the scripts folder.

40KB

gha_repo_scan_fix.py

Open

6

Copy GitHub Actions workflow file to central repository

Copy the below script and place it in a new file in the central repository under the “.github/workflows” folder. This file can be named “lineaje-unifai-scan.yaml”.

The on: events can be modified to trigger off new commits, new pull requests, etc. In the following example, the workflow is configured to run manually.

name: Lineaje AI Scan
on:
  workflow_dispatch:
    inputs:
      source_repo:
        description: "Repository to scan (owner/repo)"
        required: true
      branch:
        description: "Branch to scan"
        required: true
        default: "main"
jobs:
  lineaje-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout target repo
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.inputs.source_repo }}
          ref: ${{ github.event.inputs.branch }}
          token: ${{ secrets.GITHUB_TOKEN }}
          path: target-repo
      - name: Checkout scanner scripts
        uses: actions/checkout@v4
        with:
          repository: ${{ github.repository }}
          path: .lineaje-scanner
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install dependencies
        run: pip install mcp
      - name: Run Lineaje AI policy scan with fix PR
        env:
          LINEAJE_PAT_TOKEN: ${{ secrets.LINEAJE_PAT_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TARGET_SHA=$(git -C target-repo rev-parse HEAD)
          python .lineaje-scanner/scripts/gha_repo_scan_fix.py \
            --source-path target-repo \
            --repo "${{ github.event.inputs.source_repo }}" \
            --branch "${{ github.event.inputs.branch }}" \
            --head-sha "$TARGET_SHA" \
            --create-fix-pr \
          | tee scan_result.txt
      - name: Publish scan result to job summary
        if: always()
        run: cat scan_result.txt >> $GITHUB_STEP_SUMMARY

7

Run the GitHub Actions workflow

Run the GitHub Actions workflow and discover AI Assets using UnifAI. Based on the trigger setup, the workflow may be triggered automatically.

Set Up GitHub SaaS with GitHub Action

These steps set up a GitHub Actions workflow that authenticates to Lineaje, runs a UnifAI scan on your GitHub.com repository, and opens a remediation pull request with the fixes.

Before You Start

• A GitHub.com repository

• A Lineaje Personal Access Token (PAT)

• Enable UnifAI policies

Setup

1

Step 1: Obtain a Lineaje Personal Access Token (PAT)

The Lineaje PAT is obtained from the SBOM360 Integrations page:

• Log in at app.veedna.com and navigate to SBOM360 → Integrations → Deploy Private Cloud → Personal Access Token.

• Click the link in the box.

• Click Generate Token. A Lineaje web page opens asking you to authenticate.

• Authenticate and click Yes. You are returned to the Integrations page.

• Copy the PAT displayed on the Integrations page.

2

Step 2: Setup Central Repository with Lineaje PAT

• Create a new GitHub repository in the same organization as your other repositories.

• Follow https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets to add a new secret called LINEAJE_PAT_TOKEN.

3

Step 3: Copy Script to Central Repository

Download the following script and place it in the central repository under the "scripts" folder.

40KB

gha_repo_scan_fix.py

Open

4

Step 4: Copy GitHub Actions Workflow File to Central Repository

Copy the below script and place it in a new file in the central repository under the ".github/workflows" folder. This file can be named "lineaje-ai-scan.yaml".

The on events can be modified to trigger off new commits, new pull requests etc.

In the below example, the workflow is configured to run manually.

name: Lineaje AI Scan

on:
  workflow_dispatch:
    inputs:
      source_repo:
        description: "Repository to scan (owner/repo)"
        required: true
      branch:
        description: "Branch to scan"
        required: true
        default: "main"

jobs:
  lineaje-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout target repo
        uses: actions/checkout@v4
        with:
          repository: ${{ github.event.inputs.source_repo }}
          ref: ${{ github.event.inputs.branch }}
          token: ${{ secrets.GITHUB_TOKEN }}
          path: target-repo

      - name: Checkout scanner scripts
        uses: actions/checkout@v4
        with:
          repository: ${{ github.repository }}
          path: .lineaje-scanner

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: pip install mcp

      - name: Run Lineaje AI policy scan with fix PR
        env:
          LINEAJE_PAT_TOKEN: ${{ secrets.LINEAJE_PAT_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          TARGET_SHA=$(git -C target-repo rev-parse HEAD)
          python .lineaje-scanner/scripts/gha_repo_scan_fix.py \
            --source-path target-repo \
            --repo "${{ github.event.inputs.source_repo }}" \
            --branch "${{ github.event.inputs.branch }}" \
            --head-sha "$TARGET_SHA" \
            --create-fix-pr \
            | tee scan_result.txt

      - name: Publish scan result to job summary
        if: always()
        run: cat scan_result.txt >> $GITHUB_STEP_SUMMARY

5

Step 5: Run the GitHub Actions workflow.

Run the GitHub Actions workflow and discover AI Assets using UnifAI. Based on the trigger setup, the workflow may be triggered automatically.