Learning Labs: Trusted CI/CD with Chainguard Actions
About this event
Agentic development is pushing more code through CI than ever, and platform teams are enforcing SHA pinning across their organizations. After the tj-actions and Trivy compromises, few argue against it. But pinning guarantees that code doesn't change, not who wrote it. A pinned SHA can point to an attacker's commit and still pass your review, audit log, and policy scanner.
Join Erika Heidi, Staff DevRel Engineer at Chainguard, to learn where SHA pinning falls short and how to build real trust into your GitHub Actions supply chain.
We'll cover:
What org-level pin enforcement actually verifies
How impostor commits work, and why GitHub makes them possible
What GitHub's 2026 Actions roadmap addresses, and what it doesn't
How Chainguard Actions provides hardened, trusted actions
