Yorkshire DevOps 4th Anniversary - Lloyds Banking Group

Yorkshire DevOps is turning four! Join us on Thursday 5 November 2026 for our 4th anniversary event, hosted by Lloyds Banking Group at their Leeds office. Thank you to everyone who has spoken, hosted, sponsored and turned up over the last four years.

You can find our code of conduct at: https://yorkshiredevops.dev/

Talk title: The comforting lie of SHA pinning in GitHub Actions
Speaker: Aiden Vaines, Director Consulting Expert at CGI
Abstract:
Pinning GitHub Actions to a commit SHA is one of the most common pieces of supply chain advice around, and it does make your workflows look immutable. But immutable isn't the same as trustworthy. Knowing a reference won't change tells you nothing about where that code came from.
Aiden explores the gap between immutability and provenance, and why pinning on its own isn't enough.

You'll come away with a clearer view of what SHA pinning does and doesn't protect you from, and what else matters when you're trusting third-party actions in your pipelines.

About Aiden:
Aiden is a cloud engineering leader who writes and talks about the cloud, infrastructure, delivery and security. He has spent more than twenty years building production systems, and remains suspicious of anything that looks simple in vendor documentation. You can find more of his writing at www.vaines.org.

Second speaker:
Talk title: Building and scaling an open-source observability platform
Talk description: Commercial observability platforms are excellent at taking a team from zero to visibility. Their pricing, though, is tied to the things a growing platform keeps adding: hosts, containers, metrics, logs and traces. At some point the monitoring bill stops being an operating expense and becomes a tax on success. Meanwhile, internal URLs, request paths and log payloads are leaving the organisation’s own infrastructure.

This talk makes the case for running observability yourself, on Kubernetes, with open-source components and cheap object storage. It starts with the economics and the data-ownership argument. It then walks through a reference stack (OpenTelemetry, Prometheus, Mimir, Loki, Tempo, Pyroscope and Grafana) deployed with a single Terraform module. Next it covers what breaks as that stack grows: slow ad-hoc log and trace queries, and too many distributed systems to run. ClickHouse addresses both by acting as one store for every signal.
The second half introduces PulsusDB, an open-source observability database written in Rust and backed by ClickHouse. It ingests logs, metrics, traces and profiles through OpenTelemetry. It serves them back through PromQL, LogQL and TraceQL, so existing dashboards and habits keep working. Attendees leave with a deployable reference architecture, a realistic cost model and a clear picture of the trade-offs of owning their telemetry.

Speaker: Sergio Rua, Head of AI & DevOps at Digitalis.io

On the night
17:45 Arrivals and networking
18:25 Welcome and introductions
18:30 Aiden Vaines
19:00 Break
19:10 Sergio Rua
19:45 Close

Thank you to Lloyds Banking Group for hosting, and to Ada Meher and Digital Endeavours for their ongoing support of Yorkshire DevOps. To speak, sponsor or host, please email ethan.sumner@communitystack.io