{"id":16347853,"url":"https://github.com/victoriadrake/django-security-check","last_synced_at":"2025-03-16T15:31:11.818Z","repository":{"id":44692126,"uuid":"273099906","full_name":"victoriadrake/django-security-check","owner":"victoriadrake","description":"Helps you continuously monitor and fix common security vulnerabilities in your Django application.","archived":false,"fork":false,"pushed_at":"2023-02-20T14:33:41.000Z","size":158,"stargazers_count":89,"open_issues_count":0,"forks_count":13,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-02-27T04:16:57.111Z","etag":null,"topics":["continuous-integration","devsecops","django","github-actions","security","security-audit","security-automation"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/victoriadrake.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-06-17T23:43:13.000Z","updated_at":"2025-01-20T01:35:33.000Z","dependencies_parsed_at":"2024-06-18T19:59:16.458Z","dependency_job_id":null,"html_url":"https://github.com/victoriadrake/django-security-check","commit_stats":{"total_commits":16,"total_committers":3,"mean_commits":5.333333333333333,"dds":0.25,"last_synced_commit":"89623116ff4b49464c26b218d8de5eb8c4d02970"},"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victoriadrake%2Fdjango-security-check","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victoriadrake%2Fdjango-security-check/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victoriadrake%2Fdjango-security-check/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/victoriadrake%2Fdjango-security-check/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/victoriadrake","download_url":"https://codeload.github.com/victoriadrake/django-security-check/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243822312,"owners_count":20353496,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["continuous-integration","devsecops","django","github-actions","security","security-audit","security-automation"],"created_at":"2024-10-11T00:46:27.529Z","updated_at":"2025-03-16T15:31:11.544Z","avatar_url":"https://github.com/victoriadrake.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Django Security Check\n\nHelps you continuously monitor and fix common security vulnerabilities in your [Django](https://www.djangoproject.com/) application.\n\nIf you are thinking of using this action, congratulations. You're well on your way to building a secure Django project!\n\n## Use this in your workflow\n\nYou can use this action in a workflow file to continuously run [Django's `check --deploy`](https://docs.djangoproject.com/en/3.0/ref/django-admin/#check) against your production Django application configuration. Here is an example workflow that runs Django Security Check on any `push` event to the `master` branch. See [below for `env` instructions](https://github.com/victoriadrake/django-security-check#setting-the-env-variables).\n\n```yml\nname: Django Security Check\n\non:\n  push:\n    branches:\n      - master\n\nenv:\n  SECRET_KEY: ${{ secrets.SECRET_KEY }}\n  FAIL_LEVEL: WARNING\n  ENV_TYPE: venv\n  DEP_PATH: app/requirements.txt\n  APP_PATH: app/\n  EXTRA_ARGS: \"--settings=app.settings.production\"\n\njobs:\n  build:\n\n    runs-on: ubuntu-latest\n\n    steps:\n      - name: Check out master\n        uses: actions/checkout@master\n        with:\n          fetch-depth: 1\n      - name: Scan Django settings for security issues\n        id: check\n        uses: victoriadrake/django-security-check@master\n      - name: Upload output\n        uses: actions/upload-artifact@v2\n        with:\n          name: security-check-output\n          path: output.txt\n```\n\n## View results\n\nIn the example workflow file above, you can view results in the Action workflow run, or download them as an [artifact](https://docs.github.com/en/actions/configuring-and-managing-workflows/persisting-workflow-data-using-artifacts). Check out the [repositories  that use this action](https://github.com/victoriadrake/django-security-check/network/dependents) for some examples.\n\nYou can also add the check output to a comment, for example, if the workflow was triggered by a pull request. To do this, [set an output parameter](https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-an-output-parameter) and use `actions/github-script`. Here's an example workflow you can copy that runs on pull requests:\n\n```yml\nname: Django Security Check\n\non: pull_request_target\n\nenv:\n  SECRET_KEY: ${{ secrets.SECRET_KEY }}\n  FAIL_LEVEL: WARNING\n  ENV_TYPE: pipenv\n\njobs:\n  build:\n\n    runs-on: ubuntu-latest\n\n    steps:\n      - name: Check out master\n        uses: actions/checkout@master\n        with:\n          fetch-depth: 1\n      - name: Scan Django settings for security issues\n        id: check\n        uses: victoriadrake/django-security-check@master\n      - id: results\n        run: |\n          OUTPUT=$(cat output.txt)\n          FORMATTED=${OUTPUT//$'\\n'/%0A}\n          echo ::set-output name=file::**Django Security Check identified issues:** %0A$FORMATTED\n      - name: Comment with output\n        uses: actions/github-script@v3\n        with:\n          script: |\n            github.issues.createComment({\n              issue_number: ${{ github.event.number }},\n              owner: context.repo.owner,\n              repo: context.repo.repo,\n              body: `${{ steps.results.outputs.file }}`\n            })\n```\n\nThis produces:\n\n![Screenshot of security check output in comment](screenshot.png)\n\nHelpful instructions for remediation are provided by Django in the output.\n\n### Setting the `env` variables\n\nThere must be a `SECRET_KEY` value available in order for Django to run the checks. Otherwise, an `ImproperlyConfigured` exception is raised. If you don't deploy from your repository, you may use a dummy value. [Set a repository secret](https://docs.github.com/en/actions/reference/encrypted-secrets#creating-encrypted-secrets-for-a-repository) with the name of `SECRET_KEY` and include this as an environment variable as shown in the examples above.\n\nThe `FAIL_LEVEL` environment variable is the minimum severity finding that will cause the check to fail. Choices are `CRITICAL`, `ERROR`, `WARNING`, `INFO`, and `DEBUG`. If not set, it defaults to `ERROR`.\n\nDepending on what you've set as a `FAIL_LEVEL`, this action may return results without a failed check. For example, the default `ERROR` level may still return `WARNING` results, although the check is a pass. To fail the check on `WARNING` results, set `FAIL_LEVEL` to `WARNING`, `INFO`, or `DEBUG`.\n\nThis action currently supports use of [Pipenv](https://pipenv.pypa.io/en/latest/) or [`venv`](https://docs.python.org/3/library/venv.html#module-venv).\n\nIf you are using Pipenv, set `ENV_TYPE: pipenv`. Set the `DEP_PATH` variable to point to the directory containing your `Pipfile`. For example, if you have `project-root/app/Pipfile`, set `DEP_PATH: app/`. If you have `project-root/Pipfile`, you can leave this unset.\n\nIf you are using `venv`, set `ENV_TYPE: venv` as above. Set the `DEP_PATH` variable to the path of your dependencies file from the root, including the file name, as above. This is usually called `requirements.txt`, but may be different in your application.\n\nSet the `APP_PATH` to the location of your `manage.py` file. For example, if you have `project-root/application/manage.py`, then set `APP_PATH: application/`. If you have `project-root/manage.py`, you can leave this unset.\n\nIf you are not using a virtual environment, shame on you. This action will still try to help you by installing Django. Ensure you set `APP_PATH` to the directory of your `manage.py` file.\n\nYou can use `EXTRA_ARGS` to pass any additional desired arguments, such as a settings module.\n\n### Workflow customization\n\nSee full instructions for [Configuring and managing workflows](https://help.github.com/en/actions/configuring-and-managing-workflows).\n\nFor help editing the YAML file, see [Workflow syntax for GitHub Actions](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/workflow-syntax-for-github-actions).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvictoriadrake%2Fdjango-security-check","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvictoriadrake%2Fdjango-security-check","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvictoriadrake%2Fdjango-security-check/lists"}