I’ll be speaking at Yorkshire DevOps’ fourth anniversary event on Thursday, 5th November 2026Q, hosted by Lloyds Banking Group at their Wellington Place office in Leeds. The talk is based on my article, The Comforting Lie Of SHA Pinning.

I previously ran this at DevOps Nottingham a few months ago and it seemed to go down pretty well, this time its closer to home.

Pinning GitHub Actions to a full commit SHA is treated as supply-chain security best practice. But immutability is not the same as provenance.

This talk is about how a pinned SHA can still point to attacker-controlled code, why common policies may not catch it, and what teams should do beyond SHA pinning to secure their workflows.

Agenda

All times are GMT.

• 17:45 - Arrivals and networking
• 18:25 - Welcome and introductions
• 18:30 - Me!
• 19:00 - Break
• 19:10 - Second speaker
• 19:45 - Close

Location

Lloyds Banking Group - Wellington Place Office 11 & 12 Wellington Place Leeds LS1 4AP