I’ll be speaking in person at DevOps Nottingham on Tuesday, 25th August 2026 at Fothergill House. The talk is based on my article, The Comforting Lie Of SHA Pinning.

Pinning GitHub Actions to a full commit SHA is treated as supply-chain security best practice. But immutability is not the same as provenance.

This talk is about how a pinned SHA can still point to attacker-controlled code, why common policies may not catch it, and what teams should do beyond SHA pinning to secure their workflows.

Agenda

• 18:00 - Doors open
• 18:30 - Talk
• 19:15 - Pizza and catch up
• 20:00 - Doors close

Location

Fothergill House 16 King Street Nottingham NG1 2AS