[GUIDE][LineageOS][19.1] microG + SafetyNet

[Saved before deleting from Reddit] This post is based on Reddit post but adopted to my experience. ROM will be able to pass BASIC SafetyNet Attestation: working most(~95% as of now) banking apps, Google Pay; Google Contants Cloud Sync will work as expected; applications that do not support Magisk overlays will still work. For me, this is a 100% working setup. I use LineageOS myself in this form and am completely satisfied.

There are several ways to get LineageOS to your device. First: official, without pre-installed microG and GApps. Second: unofficial, but with a built-in microG out of the box. My instruction is written based on the first type of builds. LineageOS for microG is a wonderful project, but I needed Play Store so that applications would not have problems with license verifications (Repainter, KWGT, for example, do not work if there is no Play Store). And on the second type of builds, it is not possible to install Play Store, since there is a hard-coded FakeStore, which you will not be able to delete or overwrite with Play Store, I tried for a long time in many ways.

Guide:

Root with Magisk, enable Zygisk and DenyList in its options;
Install Zygisk - LSPosed Magisk module. Get latest MinMicroG release here (version from 16 Jan 2023 on my device) (choose edition yourself, Standard edition if you want to have exact my setup). Flash it in TWRP and reboot into system;
Install FakeGApps apk. Install Displax forked SafetyNet Fix Magisk module this version (2.4 version can't pass CTS);
Install microG apk accordingly to version of MinMicroG (0.2.27.223616 accordingly to the MinMicroG version on my device) (update existing apk installed from TWRP, needed because else microG settings would crash because of SafetyNetFix, also you can't grant all permissions to microG);
Grant all permissions to microG in its settings. To grant GPS in background permission, enable GPS once and go into microG settings;
Hide Magisk through its settings, give it whatever name you want. Also in DenyList, check banking applications, GPay.