Evolving Atlassian's deployment controls enforcement

This post details the evolution of Atlassian's deployment controls, moving from an implicit trust model to a direct source and build provenance verification system at deployment time. It introduces the Artifact Metadata Store (Metadata-API) inspired by Grafeas, standardizing artifact metadata and centralizing its storage. The post describes the collection of build provenance from Bitbucket Pipelines and Bamboo Server, and how attestations are used to link artifacts to their builds and sources, including specific integrations with Artifactory, Config Registry, Bifrost, and Micros Providers. The focus is on minimizing developer friction by using an observation-based approach.