Cost
pip cache, scoped triggers, and one deploy path keep AWS CI predictable.
A Python workflow with pip caching and AWS deploy hooks.
# Created by https://pipegrade.io# Template: Django + AWS + Pytest# Edit at https://pipegrade.io/github-actions/django-aws-pytest name: Django CIon: # Run only when Python app, tests, or dependency manifests change. push: branches: - main paths: - app/** - tests/** - requirements*.txt - pyproject.toml pull_request: paths: - app/** - tests/** - requirements*.txt - pyproject.toml permissions: # Keep the default token read-only; AWS credentials stay scoped to the deploy step. contents: read concurrency: # Cancel stale PR runs so only the newest commit keeps consuming runner time. group: django-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true jobs: test: # Django checks and Pytest should fail fast instead of running to the platform limit. timeout-minutes: 25 runs-on: ubuntu-latest env: DJANGO_SETTINGS_MODULE: config.settings.test steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 with: python-version: '3.12' # Cache pip downloads using dependency manifests detected by setup-python. cache: pip - run: python -m pip install --upgrade pip - run: pip install -r requirements.txt -r requirements-dev.txt - run: python manage.py check --deploy - run: pytest - run: python -m build # No artifacts are uploaded by default. If you add coverage or build archives, set retention-days. - name: Deploy to AWS if: github.ref == 'refs/heads/main' env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }} AWS_APPLICATION_NAME: ${{ secrets.AWS_APPLICATION_NAME }} run: aws deploy push --application-name "$AWS_APPLICATION_NAME" - name: Notify on failure if: failure() run: echo "Send a failure notification to your team channel."Why it grades A
pip cache, scoped triggers, and one deploy path keep AWS CI predictable.
Actions are pinned to full commit SHAs and workflow permissions are read-only by default.
Build and test work is kept in one deterministic job unless the stack has a real dependency boundary.
Every job has timeout-minutes, a concurrency group, and clear deploy gating on main.
Already have a workflow?
Customize
Rules addressed
missing-dependency-cacheunpinned-actionmissing-top-level-permissionsmissing-path-filtersmissing-pr-cancel-concurrencymissing-timeout-minutesmissing-concurrency-groupmissing-failure-notificationRelated templates
Updates
These templates use reviewed action SHAs. Get notified when the template library expands.