Path B: GitHub On-Premises

Use this path if you run self-hosted GitHub (GitHub Enterprise Server) and want everything — GitHub, the MCP server, and scan orchestration — inside your network. The Action runs on a self-hosted runner and connects only to your on-premises MCP server. Your source code is scanned locally and never sent to Lineaje.

Before You Start

• A self-hosted GitHub repository, with permission to add secrets and to run self-hosted GitHub Actions runners.

• A self-hosted runner in the same network as the MCP server.

• A Lineaje PAT.

• A VM that meets the specifications, with outbound network access on port 443 to Lineaje SaaS.

MCP Server Specifications (EC2)

The MCP server can be hosted on EC2 with the following specification:

Component	MCP Server
Compute	4 vCPU
Memory	8 GB RAM
OS	Linux
Architecture	x86_64
Storage Type	Amazon EFS
Cache	Redis (SSL Enabled)

On-Premises VM Specifications (vLLM)

For the on-premises solution, customers deploy an open-source model on the VM. vLLM must be installed on the VM with the following minimum requirements:

Property	Value
Instance type	g6.12xlarge
Family	g6
vCPUs	48
OS	Ubuntu 24.04 (Noble)
Storage	1 TB
GPU	4× NVIDIA L4 (24 GB each = 96 GB total)
GPU VRAM	96 GB total

vLLM OS Prerequisites

• Supported OS: Ubuntu 22.04 or 24.04 (recommended).

• NVIDIA Driver: 525 or later

• CUDA: 11.8 or later

• Docker: 24 or later

• Python: 3.10 or later (for Ansible)

• Storage: Minimum 200 GB for models and Docker images

Steps for Github On-Premises

1

Generate a Lineaje PAT

A Lineaje PAT authenticates the GitHub Action to Lineaje.

This step is required even if you already have a GitHub PAT for SBOM360. A GitHub PAT authenticates SBOM360 to GitHub; a Lineaje PAT authenticates GitHub Actions to Lineaje.

Follow these steps to generate a Lineaje PAT from your Lineaje account. The token grants the Action access to the Lineaje scan service:

1. Log in at app.veedna.com and navigate to SBOM360 → Integrations → Deploy Private Cloud → Personal Access Token.

2. Click the link in the box.

3. Click Generate Token. A Lineaje web page opens.

4. Authenticate and click Yes. You are returned to the Integrations page.

5. Copy the PAT displayed on the Integrations page.

2

Set Up the VM with the MCP Server

Deploy the Lineaje MCP server on a VM inside your network. The GitHub Action connects to this server during each scan.

• A GPU is required for the vLLM setup. Lineaje hosts an open-source LLM/SLM.

• Outbound network access from the VM on port 443 to Lineaje SaaS is required.

• The Lineaje MCP server package and deployment script must be available on the VM.

Follow these steps to set up the VM with the MCP server:

1. Provision a VM that meets the specifications in Before You Start.

2. Install vLLM and the OS prerequisites listed above.

3. Deploy the Lineaje MCP server package on the VM and start the server.

4. Note the server’s URL (for example, https://your-vm-host.internal/mcp). Reference this URL in the workflow YAML in Step 4.

3

Add the Lineaje PAT to Your GitHub Repository or Organization

Store the Lineaje PAT as an encrypted secret so the GitHub Action can read it at runtime.

1. In your self-hosted GitHub, go to your repository (or organization) Settings → Secrets and variables → Actions.

2. Click New repository secret (or New organization secret). The secret form opens.

3. In the Name field, enter LINEAJE_PAT.

4. In the Secret field, paste the Lineaje PAT from Step 1.

5. Click Add secret. The secret appears in the list, masked.

4

Configure the GitHub Action

Configure the workflow to run on a self-hosted runner and connect to your on-premises MCP server only. Do not point this workflow at the Lineaje SaaS MCP endpoint.

Obtain the Action from the GitHub Marketplace, or copy the workflow YAML and its associated script from the Lineaje public repository.

1. In your repository, create a workflow file at .github/workflows/lineaje-unifai-scan.yaml.

2. Copy the workflow YAML into the file.

3. Set runs-on to your self-hosted runner label.

4. Set mcp-server-url to your VM’s MCP server URL from Step 2.

5. Set the scan interval in the schedule.cron field, then commit the file to your default branch. The workflow appears under the repository’s Actions tab.

name: Lineaje UnifAI Scan (On-Premises)
on:
  schedule:
    - cron: "0 2 * * *" # Scan interval — runs daily at 02:00 UTC. Set your own schedule.
  workflow_dispatch:
jobs:
  unifai-scan:
    runs-on: [self-hosted, linux] # Self-hosted runner inside your network.
    steps:
      - name: Run Lineaje UnifAI scan
        uses: lineaje/unifai-scan-action@v1 # Replace with the published Marketplace action and version.
        with:
          lineaje-pat: ${{ secrets.LINEAJE_PAT }}
          scm-token: ${{ secrets.GH_PAT }} # GitHub PAT secret with repo + project scopes.
          repository: ${{ github.repository }}
          branch: ${{ github.ref_name }}
          mcp-server-url: https://your-vm-host.internal/mcp # On-premises MCP server only — never the SaaS endpoint.
          llm-model: anthropic/claude-sonnet-4.6

To scan on each pull request, change the on: trigger as shown in Path A. The jobs: and steps: blocks stay the same.

After the scan completes, review the pull request that UnifAI opens on your repository. See Reviewing the Pull Request for details. The remediation branch is named:

remediation/unifai-pr-{pr_number}-{first_7_hex_characters_of_commit_id}