The Comforting Lie Of SHA Pinning in GitHub Actions

Talk;

Pinning GitHub Actions to a full commit SHA is treated as supply-chain security best practice. But immutability is not the same as provenance.
This talk is about how a pinned SHA can still point to attacker-controlled code, why common policies may not catch it, and what teams should do beyond SHA pinning to secure their workflows.

• Agenda;
  18:00; Doors Open
  18:30; Speaker delivers talk
  19:15; Pizza and catch up
  20:00; Doors close

Location; Fothergill House, 16 King St, Nottingham NG1 2AS