Python 3.12DjangoPytestAWS

Django + AWS + Pytest

A Python workflow with pip caching and AWS deploy hooks.

ADesigned for a clean Pipegrade scan
.github/workflows/ci.yml
# Created by https://pipegrade.io# Template: Django + AWS + Pytest# Edit at https://pipegrade.io/github-actions/django-aws-pytest name: Django CIon:  # Run only when Python app, tests, or dependency manifests change.  push:    branches:      - main    paths:      - app/**      - tests/**      - requirements*.txt      - pyproject.toml  pull_request:    paths:      - app/**      - tests/**      - requirements*.txt      - pyproject.toml permissions:  # Keep the default token read-only; AWS credentials stay scoped to the deploy step.  contents: read concurrency:  # Cancel stale PR runs so only the newest commit keeps consuming runner time.  group: django-${{ github.workflow }}-${{ github.ref }}  cancel-in-progress: true jobs:  test:    # Django checks and Pytest should fail fast instead of running to the platform limit.    timeout-minutes: 25    runs-on: ubuntu-latest    env:      DJANGO_SETTINGS_MODULE: config.settings.test    steps:      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405        with:          python-version: '3.12'          # Cache pip downloads using dependency manifests detected by setup-python.          cache: pip      - run: python -m pip install --upgrade pip      - run: pip install -r requirements.txt -r requirements-dev.txt      - run: python manage.py check --deploy      - run: pytest      - run: python -m build      # No artifacts are uploaded by default. If you add coverage or build archives, set retention-days.      - name: Deploy to AWS        if: github.ref == 'refs/heads/main'        env:          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}          AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}          AWS_APPLICATION_NAME: ${{ secrets.AWS_APPLICATION_NAME }}        run: aws deploy push --application-name "$AWS_APPLICATION_NAME"      - name: Notify on failure        if: failure()        run: echo "Send a failure notification to your team channel."

Why it grades A

Why this template grades A

Cost

Cost

pip cache, scoped triggers, and one deploy path keep AWS CI predictable.

Security

Security

Actions are pinned to full commit SHAs and workflow permissions are read-only by default.

Performance

Performance

Build and test work is kept in one deterministic job unless the stack has a real dependency boundary.

Standards

Standards

Every job has timeout-minutes, a concurrency group, and clear deploy gating on main.

Already have a workflow?

Scan it before copying a starter.

Scan your workflow

Customize

Adapt before merging

  • Confirm the path filters match the directories that should trigger CI.
  • Replace deploy commands and secret names with your actual deployment target.
  • Adjust runner labels, language versions, and timeout-minutes for your workload.
  • Scan the adapted workflow before merging it.

Rules addressed

Checks covered by this template

missing-dependency-cacheunpinned-actionmissing-top-level-permissionsmissing-path-filtersmissing-pr-cancel-concurrencymissing-timeout-minutesmissing-concurrency-groupmissing-failure-notification

Related templates

Updates

Get template updates

These templates use reviewed action SHAs. Get notified when the template library expands.