BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//talks.devopsdays.org//halifax-2026//speaker//H7V7FD
BEGIN:VTIMEZONE
TZID:America/Halifax
BEGIN:DAYLIGHT
DTSTART:20250929T000000
TZNAME:ADT
TZOFFSETFROM:-0300
TZOFFSETTO:-0300
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251102T020000
RDATE:20261101T020000
TZNAME:AST
TZOFFSETFROM:-0300
TZOFFSETTO:-0400
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260308T030000
RDATE:20270314T030000
TZNAME:ADT
TZOFFSETFROM:-0400
TZOFFSETTO:-0300
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:1\,000 Merge Requests a Week and Nobody Clicked Approve - Scott He
 bert
DTSTART;TZID=America/Halifax:20260929T113000
DTEND;TZID=America/Halifax:20260929T120000
DTSTAMP:20260922T222535Z
UID:pretalx-halifax-2026-U3QTY3@talks.devopsdays.org
DESCRIPTION:Container images ship with hundreds of packages you didn't cho
 ose\, each one a potential vulnerability. When AI-assisted security resear
 ch began surfacing real CVEs at an unprecedented rate\, we had to rethink 
 how our supply chain worked from the ground up.\n\nThis talk is the story 
 of building a fully autonomous container supply chain that monitors upstre
 am releases\, detects vulnerabilities before CVEs are published\, generate
 s package updates\, builds across architectures\, runs tests\, and ships p
 atched images — processing roughly 1\,000 merge requests per week withou
 t a human clicking approve. I'll share the architecture decisions that wor
 ked\, the ones that didn't\, and the surprising non-technical problems we 
 had to solve along the way.\n\nYou'll leave with practical patterns you ca
 n apply to your own pipelines: RPM lockfiles for deterministic builds\, re
 producible builds that let anyone verify your output\, policy-driven autom
 ation boundaries that separate "the machine handles this" from "a human ne
 eds to look\," and the guardrails that make autonomous merging safe rather
  than reckless.
LOCATION:Volta HQ
URL:https://talks.devopsdays.org/halifax-2026/talk/U3QTY3/
END:VEVENT
END:VCALENDAR