Yorkshire DevOps 4th Anniversary - Lloyds Banking Group

Yorkshire DevOps is turning four! Join us on Thursday 5 November 2026 for our 4th anniversary event, hosted by Lloyds Banking Group at their Leeds office. Thank you to everyone who has spoken, hosted, sponsored and turned up over the last four years.

You can find our code of conduct at: https://yorkshiredevops.dev/

Talk title: The comforting lie of SHA pinning in GitHub Actions
Speaker: Aiden Vaines, Director Consulting Expert at CGI
Abstract:
Pinning GitHub Actions to a commit SHA is one of the most common pieces of supply chain advice around, and it does make your workflows look immutable. But immutable isn't the same as trustworthy. Knowing a reference won't change tells you nothing about where that code came from.
Aiden explores the gap between immutability and provenance, and why pinning on its own isn't enough.

You'll come away with a clearer view of what SHA pinning does and doesn't protect you from, and what else matters when you're trusting third-party actions in your pipelines.

About Aiden:
Aiden is a cloud engineering leader who writes and talks about the cloud, infrastructure, delivery and security. He has spent more than twenty years building production systems, and remains suspicious of anything that looks simple in vendor documentation. You can find more of his writing at www.vaines.org.

Second speaker: to be confirmed soon. Watch this space!

On the night
17:45 Arrivals and networking
18:25 Welcome and introductions
18:30 Aiden Vaines
19:00 Break
19:10 Second speaker (TBC)
19:45 Close

Thank you to Lloyds Banking Group for hosting, and to Ada Meher and Digital Endeavours for their ongoing support of Yorkshire DevOps. To speak, sponsor or host, please email [email protected]