BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.devconf.info//devconf-cz-2026//talk//ZJVYFC
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-devconf-cz-2026-ZJVYFC@pretalx.devconf.info
DTSTART;TZID=CET:20260618T153000
DTEND;TZID=CET:20260618T160500
DESCRIPTION:"I thought we turned that on?" is a phrase no engineer wants to
  hear after a security incident. In a growing GitHub organization\, branch
  protection rules—like mandatory PR reviews and signed commits—often s
 uffer from configuration drift.\n\nIn this compact\, demo-driven session\,
  we’ll move beyond "manual checklists" to an automated governance model 
 using the OpenSSF Gemara project. We’ll demonstrate a "simple-by-design"
  architecture that uses Gemara to define policy\, ComplyTime to manage the
  lifecycle\, and Ampel to provide "Traffic Light" verification via signed 
 attestations.\n\nThe secret sauce? GitHub Reusable Workflows. I will showc
 ase a live "Red-to-Green" transition\, showing how any team can adopt thes
 e hardened controls instantly. Attendees will leave with a practical 25-mi
 nute blueprint for turning branch protection into a continuously monitored
 \, verifiable asset of their software supply chain.
DTSTAMP:20260430T125800Z
LOCATION:E112 (capacity 156)
SUMMARY:Hardening the Source: Scaling Branch Governance with Gemara\, Compl
 yTime and Ampel - Marcus Burghardt
URL:https://pretalx.devconf.info/devconf-cz-2026/talk/ZJVYFC/
END:VEVENT
END:VCALENDAR