Verifying Artifacts and CVEs at the Change Boundary

At Thoughtworks, we talk a lot about Compliance at the Point of Change. To simplify, the core of this concept is we give developers freedom by moving all compliance checks to the admission controllers of the deployment platform. This allows devs to completely own the pipelines, and they are responsible for meeting the admission controller requirements on deployment. In this talk, we'll look at how to write admission controllers that block deployments when an application has an invalid SBOM or high severity CVE in it's packages.