Profile: Victoria Drake on Building Reusable Security Actions
Victoria Drake’s path into software development began with summer holidays spent coding medieval fantasy worlds with friends, where she fell in love with the Telnet terminal and learned object-oriented programming. That foundation still shapes how she approaches her work today as a senior software developer at a cybersecurity company and a core maintainer for the Open Web Application Security Project (OWASP) Web Security Testing Guide (WSTG).
“Whether I’m creating an open source tool or leading a development team, my childhood experience still informs how I think about programming today. I strive to create repeatable units of software like GitHub Actions — only now, I make them for large enterprises in the real world!”
Two Actions for Different Jobs
Among the several GitHub Actions Drake has built, two stand out as her favourites. The first, Hugo-Remote, supports continuous deployment of a Hugo static site from a private repository to a GitHub Pages repository. Its key benefit is keeping the source repository private while still allowing a public site on GitHub Pages.
The second, django-security check, scans a Django application for security vulnerabilities or misconfigurations. Drake describes it as “your little CI/CD helper for busy projects — a security linter!”
Both actions are available on GitHub Marketplace.
Motivations and Challenges
Drake builds these tools in her free time because she has found that she is most productive when she creates systems that make desired outcomes inevitable. She applies that same principle to helping other developers ship secure software.
“I’m a full-time senior software developer at a cybersecurity company. I’ve found that I’m [the most] productive when I create systems and processes that help myself and my team make desired outcomes inevitable. So I spend my free time building tools that make it easy for other developers to build secure software as well. My Actions help to automate contained, repeatable units of work that can make a big difference in a developer’s day… I’m happiest when I’m solving a challenge that makes developing secure software less challenging in the future, both for myself and for the technology organization I’m leading.”
The hardest part of adopting GitHub Actions, in Drake’s experience, is rarely technical. It tends to be the cultural shift around moving away from legacy software:
“Migrating legacy software is always challenging, particularly with large legacy applications. Moving to modern CI/CD processes requires changes at the software level, team level, and even a shift in thinking when it comes to individual developers. It can help to have a tool like GitHub Actions, which is at once seamlessly modern and familiar, when transitioning legacy code to a modern pipeline.”
Once that transition is underway, though, building Actions is straightforward because they rely on familiar, portable technology. For Dockerized Actions specifically, Drake notes that teams can code in whatever language they already know:
“In the case of a Dockerized Action, you can use any language your team is comfortable with. This is especially useful in large organizations with polyglot teams and environments. There aren’t any complicated dependencies for running these portable tasks, and you don’t need to learn any special frameworks to get started.”
Automation as a Continuous Effort
Drake’s work with GitHub Actions extends well beyond the two tools she released publicly. At work and in her open source projects, she has championed automation to maintain quality, deploy new versions securely, and raise the velocity of technical teams. Her focus is on continuously finding new ways the platform can make developers’ lives easier and their projects more secure.
For anyone looking to get started, GitHub offers a Learning Lab course on building your first Action, and hundreds of community-built examples are available on GitHub Marketplace. Actions created during the GitHub Actions Hackathon are also available to explore.
