feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/__init__.py

@@ -0,0 +1,67 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Artifact Registry repositories."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.UniverseCompatible
+class Repositories(base.Group):
+  """Manage Artifact Registry repositories.
+
+  ## EXAMPLES
+
+  To create a repository with the name `my-repo`, run:
+
+    $ {command} create my-repo
+
+  To delete a repository with the name `my-repo`, run:
+
+    $ {command} delete my-repo
+
+  To describe a repository with the name `my-repo`, run:
+
+    $ {command} describe my-repo
+
+  To list all Artifact Registry repositories, run:
+
+    $ {command} list
+
+  To set an IAM policy for repository `my-repo`, run:
+
+    $ {command} set-iam-policy my-repo policy.json
+
+  To get an IAM policy for repository `my-repo`, run:
+
+    $ {command} get-iam-policy my-repo
+
+  To add an IAM policy binding for the role of 'roles/editor' for the user
+  'test-user@gmail.com' on  repository `my-repo`, run:
+
+    $ {command} add-iam-policy-binding my-repo
+    --member='user:test-user@gmail.com' --role='roles/editor'
+
+  To remove an IAM policy binding for the role of 'roles/editor' for the user
+  'test-user@gmail.com' on repository `my-repo`, run:
+
+    $ {command} remove-iam-policy-binding my-repo
+    --member='user:test-user@gmail.com' --role='roles/editor'
+  """
+
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/add_iam_policy_binding.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief:  |
+      Add an IAM policy binding to the IAM policy of an Artifact Registry repository.
+    description: |
+      *{command}* adds an IAM policy binding to the IAM policy of an Artifact Registry
+      repository. One binding consists of a member, a role, and an optional condition.
+
+      This command can fail for the following reasons:
+        * The repository specified does not exist.
+        * The active account does not have permission to access the given
+          repository's IAM policies.
+    examples: |
+      To add an IAM policy binding for the role of 'roles/editor' for the user
+      'test-user@gmail.com' with repository 'my-repo', run:
+
+        $ {command} my-repo --member='user:test-user@gmail.com' --role='roles/editor'
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      policy role and member types.
+
+  request: &request
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        Name of the Artifact Registry repository.
+
+  iam:
+    enable_condition: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/config/__init__.py

@@ -0,0 +1,26 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2021 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for managing Artifact Registry repository configurations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class Config(base.Group):
+  """Manage Artifact Registry repository configurations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/config/export.yaml

@@ -0,0 +1,38 @@
+release_tracks: [ALPHA]
+command_type: CONFIG_EXPORT
+help_text:
+  brief: Export the configuration for a Artifact Registry repository.
+  description: |
+    *{command}* exports the configuration for a Artifact Registry repository.
+
+    Repository configurations can be exported in
+    Kubernetes Resource Model (krm) or Terraform HCL formats. The
+    default format is `krm`.
+
+    Specifying `--all` allows you to export the configurations for all
+    repositories within the project.
+
+    Specifying `--path` allows you to export the configuration(s) to
+    a local directory.
+  examples: |
+    To export the configuration for a repository, run:
+
+      $ {command} my-repository
+
+    To export the configuration for a repository to a file, run:
+
+      $ {command} my-repository --path=/path/to/dir/
+
+    To export the configuration for a repository in Terraform
+    HCL format, run:
+
+      $ {command} my-repository --resource-format=terraform
+
+    To export the configurations for all repositories within a
+    project, run:
+
+      $ {command} --all
+arguments:
+  resource:
+    help_text: Repository to export the configuration for.
+    spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/copy.py

@@ -0,0 +1,155 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Copy an Artifact Registry repository."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.util import waiter
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.artifacts import flags
+from googlecloudsdk.command_lib.artifacts import requests
+from googlecloudsdk.core import log
+from googlecloudsdk.core import resources
+from googlecloudsdk.core.console import progress_tracker
+from googlecloudsdk.core.util import retry
+
+
+@base.UniverseCompatible
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+@base.Hidden
+class Copy(base.Command):
+  """Copy an Artifact Registry repository."""
+
+  detailed_help = {
+      'BRIEF': 'Copy an Artifact Registry repository.',
+      'DESCRIPTION': """
+          Copy all artifacts within an Artifact Registry repository to another repository.
+
+          Note that this is pull-based, so default arguments will apply to the destination repository.
+      """,
+      'EXAMPLES': """\
+          To copy artifacts from `repo1` in project `proj1` and location `us` to `repo2` in project `proj2` and location `asia`:
+
+            $ {command} repo2 --project=proj2 --location=asia --source-repo=projects/proj1/locations/us/repositories/repo1
+      """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    """Set up arguments for this command.
+
+    Args:
+      parser: An argparse.ArgumentParser.
+    """
+    flags.GetRepoArg().AddToParser(parser)
+    base.ASYNC_FLAG.AddToParser(parser)
+    parser.add_argument(
+        '--source-repo',
+        metavar='SOURCE_REPOSITORY',
+        required=True,
+        help='The source repository path to copy artifacts from.',
+    )
+
+  def Run(self, args):
+    """Run the repository copy command."""
+    # Call CopyRepository API.
+    client = requests.GetClient()
+    repo_ref = args.CONCEPTS.repository.Parse()
+    op = requests.CopyRepository(args.source_repo, repo_ref.RelativeName())
+    op_ref = resources.REGISTRY.ParseRelativeName(
+        op.name, collection='artifactregistry.projects.locations.operations'
+    )
+
+    # Log operation details and return if not waiting.
+    log.status.Print(
+        'Copy request issued from [{}] to [{}].\nCreated operation [{}].'
+        .format(
+            args.source_repo, repo_ref.RelativeName(), op_ref.RelativeName()
+        )
+    )
+    if args.async_:  # Return early if --async is specified.
+      return None
+
+    # Progress tracker for polling loop.
+    spinner_message = 'Copying artifacts'
+    progress_info = {'copied': 0, 'total': 0}
+    with progress_tracker.ProgressTracker(
+        spinner_message,
+        detail_message_callback=lambda: self._DetailMessage(progress_info),
+        autotick=True,
+    ):
+      # Before polling, let user know to press CTRL-C to stop.
+      log.status.Print('Press CTRL-C to stop waiting on the operation.')
+
+      # Poll operation indefinitely.
+      poller = waiter.CloudOperationPollerNoResources(
+          client.projects_locations_operations
+      )
+      retryer = retry.Retryer(max_wait_ms=None)
+      try:
+        operation = retryer.RetryOnResult(
+            lambda: self._PollOperation(poller, op_ref, progress_info),
+            should_retry_if=lambda op, state: op and not op.done,
+            sleep_ms=2000,
+        )
+        if operation.error:
+          log.status.Print(
+              '\nOperation [{}] failed: {}'.format(
+                  op_ref.RelativeName(), operation.error.message
+              )
+          )
+        return None
+      except retry.WaitException:
+        # This block should not be reached with max_wait_ms=None
+        log.error('Error: Copy operation wait unexpectedly timed out.')
+        return None
+      except Exception as e:  # pylint: disable=broad-exception-caught
+        log.fatal('An unexpected error occurred: {}'.format(e))
+        return None
+
+  def _DetailMessage(self, progress_info):
+    """Callback to update the progress tracker message."""
+    copied = progress_info['copied']
+    total = progress_info['total']
+
+    if total == 0:
+      return ' operation metadata not yet available'
+
+    progress = copied / total * 100
+    return ' {:.1f}% copied ({} of {} versions)'.format(progress, copied, total)
+
+  def _PollOperation(self, poller, op_ref, progress_info):
+    """Polls the operation and updates progress_info from metadata."""
+    try:
+      operation = poller.Poll(op_ref)
+    except waiter.PollException as e:
+      # Handle potential polling errors if necessary
+      log.debug('Polling error: %s', e)
+      return None  # Continue polling
+
+    if (
+        operation
+        and operation.metadata
+        and operation.metadata.additionalProperties
+    ):
+      props = {p.key: p.value for p in operation.metadata.additionalProperties}
+      if 'versionsCopiedCount' in props:
+        progress_info['copied'] = props['versionsCopiedCount'].integer_value
+      if 'totalVersionsCount' in props:
+        progress_info['total'] = props['totalVersionsCount'].integer_value
+
+    return operation

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/create.yaml

@@ -0,0 +1,257 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: |
+      Create an Artifact Registry repository.
+    description: |
+      Create a new Artifact Registry repository.
+
+      This command can fail for the following reasons:
+        * A repository with the same name already exists.
+        * The active account does not have permission to create repositories.
+        * A valid repository format was not provided.
+    examples: |
+      To create a docker repository with the name `my-repo` in the default project and location, run the following command:
+
+        $ {command} my-repo --repository-format=docker
+
+      To create a docker repository `my-repo` with a KMS key
+      `projects/my-project/locations/us/keyRings/my-kr/cryptoKeys/my-key` in the default project and location, run the following command:
+
+        $ {command} my-repo --repository-format=docker --kms-key=projects/my-project/locations/us/keyRings/my-kr/cryptoKeys/my-key
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The Artifact Registry repository to create.
+    params:
+    - arg_name: description
+      api_field: repository.description
+      help_text: |
+        Description for the repository.
+    - arg_name: kms-key
+      api_field: repository.kmsKeyName
+      help_text: |
+        Name of the encryption key that's used for encrypting the contents of the repository.
+    - arg_name: allow-snapshot-overwrites
+      type: bool
+      default: null
+      api_field: repository.mavenConfig.allowSnapshotOverwrites
+      help_text: |
+        (Maven only) Allow repository users to publish a snapshot that overwrites the same snapshot version in the repository.
+    - arg_name: version-policy
+      api_field: repository.mavenConfig.versionPolicy
+      help_text: |
+        (Maven only) The package versions that the repository will store.
+      choices:
+      - arg_value: NONE
+        enum_value: VERSION_POLICY_UNSPECIFIED
+        help_text: (Maven only) The repository doesn't validate the version type.
+      - arg_value: RELEASE
+        enum_value: RELEASE
+        help_text: (Maven only) The repository accepts release versions only.
+      - arg_value: SNAPSHOT
+        enum_value: SNAPSHOT
+        help_text: (Maven only) The repository accepts snapshot versions only.
+    - arg_name: mode
+      api_field: repository.mode
+      default: NONE
+      help_text: |
+        Mode is the type of the repository - Standard, Virtual or Remote.
+      choices:
+      - arg_value: NONE
+        enum_value: MODE_UNSPECIFIED
+        help_text: Repository mode not specified.
+      - arg_value: STANDARD-REPOSITORY
+        enum_value: STANDARD_REPOSITORY
+        help_text: Standard repository mode - should be possible to write/read data to this repo.
+      - arg_value: VIRTUAL-REPOSITORY
+        enum_value: VIRTUAL_REPOSITORY
+        help_text: Virtual repository mode - aggregates data from several upstreams.
+      - arg_value: REMOTE-REPOSITORY
+        enum_value: REMOTE_REPOSITORY
+        help_text: Remote repository mode - fetches data from upstream and caches it.
+    - arg_name: remote-repo-config-desc
+      api_field: repository.remoteRepositoryConfig.description
+      help_text: |
+        The description for the remote repository config.
+    - arg_name: immutable-tags
+      type: bool
+      api_field: repository.dockerConfig.immutableTags
+      default: null
+      help_text: |
+        (Docker only) Prevent changes to tagged images in the repository. Tags cannot be deleted or moved to a different image digest, and tagged images cannot be deleted.
+    - arg_name: remote-apt-repo-path
+      api_field: repository.remoteRepositoryConfig.aptRepository.publicRepository.repositoryPath
+      help_text: |
+        (Apt only) Remaining URL path to apt remote repository.
+    - arg_name: remote-yum-repo-path
+      api_field: repository.remoteRepositoryConfig.yumRepository.publicRepository.repositoryPath
+      help_text: |
+        (Yum only) Remaining URL path to yum remote repository.
+    - arg_name: disable-remote-validation
+      type: bool
+      api_field: repository.remoteRepositoryConfig.disableUpstreamValidation
+      default: null
+      help_text: |
+        Do not make an HTTP request to validate the remote upstream. Not recommended when setting a custom remote upstream unless you are absolutely sure your upstream URI and any auth is valid.
+    - arg_name: enable-ingestion-attestation
+      type: bool
+      api_field: repository.remoteRepositoryConfig.enableIngestionAttestation
+      default: null
+      hidden: true
+      help_text: |
+        Enable generating attestation with verifiable signature on imported files in remote repositories.
+    - arg_name: alternative-hostname
+      api_field: repository.networkConfig.alternativeHostname
+      hidden: true
+      default: null
+      help_text: |
+        An alternative hostname that a repository can be accessed through.
+    - arg_name: alternative-hostname-path-prefix
+      api_field: repository.networkConfig.prefix
+      hidden: true
+      default: null
+      help_text: |
+        An alternative hostname path prefix that a repository can be accessed through.
+    - arg_name: alternative-hostname-default
+      api_field: repository.networkConfig.isDefault
+      hidden: true
+      default: null
+      help_text: |
+        Whether this is the default repository for the alternative hostname if no repository matches the path prefix.
+    - group:
+        mutex: true
+        params:
+        - arg_name: allow-vulnerability-scanning
+          api_field: repository.vulnerabilityScanningConfig.enablementConfig
+          default: null
+          action: store_true
+          help_text: |
+            Allow vulnerability scanning on the repository.
+          choices:
+          - arg_value: true
+            enum_value: INHERITED
+            help_text: Vulnerability scanning enablement config set to inherited.
+        - arg_name: disable-vulnerability-scanning
+          api_field: repository.vulnerabilityScanningConfig.enablementConfig
+          default: null
+          action: store_true
+          help_text: |
+            Disable vulnerability scanning on the repository.
+          choices:
+          - arg_value: true
+            enum_value: DISABLED
+            help_text: Vulnerability scanning enablement config set to disabled.
+    - group:
+        mutex: true
+        hidden: true
+        params:
+        - arg_name: allow-sbom-generation
+          api_field: repository.sbomConfig.enablementConfig
+          default: null
+          action: store_true
+          hidden: true
+          help_text: |
+            Allow SBOM generation on the repository.
+          choices:
+          - arg_value: true
+            enum_value: INHERITED
+            help_text: SBOM generation enablement config set to inherited.
+        - arg_name: disable-sbom-generation
+          api_field: repository.sbomConfig.enablementConfig
+          default: null
+          action: store_true
+          hidden: true
+          help_text: |
+            Disable SBOM generation on the repository.
+          choices:
+          - arg_value: true
+            enum_value: DISABLED
+            help_text: SBOM generation enablement config set to disabled.
+    labels:
+      api_field: repository.labels
+    additional_arguments_hook: googlecloudsdk.command_lib.artifacts.util:AddAdditionalArgs
+
+  async:
+    collection: artifactregistry.projects.locations.operations
+
+  request:
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.artifacts.util:CheckServiceAccountPermission
+    - googlecloudsdk.command_lib.artifacts.util:AppendRepoDataToRequest
+    - googlecloudsdk.command_lib.artifacts.util:AppendUpstreamPoliciesToRequest
+    - googlecloudsdk.command_lib.artifacts.util:SanitizeRemoteRepositoryConfig
+
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: |
+      Create an Artifact Registry repository.
+    description: |
+      Create a new Artifact Registry repository.
+
+      This command can fail for the following reasons:
+        * A repository with the same name already exists.
+        * The active account does not have permission to create repositories.
+        * A valid repository format was not provided.
+    examples: |
+      To create a repository with the name `my-repo` under the current project, run:
+
+        $ {command} my-repo
+
+      To create repository `my-repo` with a KMS key
+      `projects/my-project/locations/us/keyRings/my-kr/cryptoKeys/my-key`, run:
+
+        $ {command} my-repo --kms-key=projects/my-project/locations/us/keyRings/my-kr/cryptoKeys/my-key
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The Artifact Registry repository to create.
+    params:
+    - arg_name: description
+      api_field: repository.description
+      help_text: |
+        Description for the repository.
+    - arg_name: kms-key
+      api_field: repository.kmsKeyName
+      help_text: |
+        Name of the encryption key that's used for encrypting the contents of the repository.
+    - arg_name: allow-snapshot-overwrites
+      type: bool
+      default: null
+      api_field: repository.mavenConfig.allowSnapshotOverwrites
+      help_text: |
+        (Maven only) Allow repository users to publish a snapshot that overwrites the same snapshot version in the repository.
+    - arg_name: version-policy
+      api_field: repository.mavenConfig.versionPolicy
+      help_text: |
+        (Maven only) The package versions that the repository will store.
+      choices:
+      - arg_value: NONE
+        enum_value: VERSION_POLICY_UNSPECIFIED
+        help_text: (Maven only) The repository doesn't validate the version type.
+      - arg_value: RELEASE
+        enum_value: RELEASE
+        help_text: (Maven only) The repository accepts release versions only.
+      - arg_value: SNAPSHOT
+        enum_value: SNAPSHOT
+        help_text: (Maven only) The repository accepts snapshot versions only.
+    labels:
+      api_field: repository.labels
+    additional_arguments_hook: googlecloudsdk.command_lib.artifacts.util:AddRepositoryFormatArgBeta
+
+  async:
+    collection: artifactregistry.projects.locations.operations
+
+  request:
+    api_version: v1beta2
+    collection: artifactregistry.projects.locations.repositories
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.artifacts.util:CheckServiceAccountPermission
+    - googlecloudsdk.command_lib.artifacts.util:AppendRepoDataToRequest

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/delete.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Delete an Artifact Registry repository.
+    description: |
+      Delete an Artifact Registry repository. Before you delete a repository, ensure that any
+      active dependencies on this repository are adjusted to use a new location.
+
+      This command can fail for the following reasons:
+        * The specified repository does not exist.
+        * The active account does not have permission to delete repositories.
+    examples: |
+      To delete repository named `my-repo` under the current project, run:
+
+        $ {command} my-repo
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The Artifact Registry repository to delete.
+
+  async:
+    collection: artifactregistry.projects.locations.operations
+
+  request:
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/delete_cleanup_policies.yaml

@@ -0,0 +1,46 @@
+- release_tracks: [GA]
+  universe_compatible: false
+
+  help_text:
+    brief: |
+      Delete cleanup policies from an Artifact Registry repository.
+    description: |
+      Delete cleanup policies from an Artifact Registry repository.
+
+      This command can fail for the following reasons:
+        * The given repository does not exist.
+        * The active account does not have permission to update repositories.
+    examples: |
+      To delete a cleanup policy named `policy_a` from the repository `my-repo`, run:
+
+        $ {command} my-repo --policynames=policy_a
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The Artifact Registry repository to update.
+
+    params:
+    - arg_name: policynames
+      required: true
+      help_text: |
+        Comma-separated list of cleanup policy names to delete.
+
+
+  command_type: UPDATE
+  request:
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.artifacts.cleanup_policy_util:DeleteCleanupPolicyFields
+
+  update:
+    read_modify_update: true
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.artifacts.cleanup_policy_util:RepositoryToCleanupPoliciesResponse
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/describe.yaml

@@ -0,0 +1,27 @@
+- release_tracks: [ALPHA, BETA, GA]
+  help_text:
+    brief: |
+      Describe an Artifact Registry repository.
+    description: |
+      Describe an Artifact Registry repository given the repository name.
+    examples: |
+      To describe a repository named `my-repo` under the current project in
+      `us-west1`, run:
+
+        $ {command} my-repo --location=us-west1
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The Artifact Registry repository to describe.
+
+  request: &request
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.artifacts.util:AddEncryptionLogToRepositoryInfo
+    - googlecloudsdk.command_lib.artifacts.util:AddRegistryBaseToRepositoryInfo
+    - googlecloudsdk.command_lib.artifacts.util:ConvertBytesToMB

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/get_iam_policy.yaml

@@ -0,0 +1,29 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief:  |
+      Get IAM policy for an Artifact Registry repository.
+    description: |
+      *{command}* displays the IAM policy associated with an Artifact Registry repository.
+      The output includes an "etag" identifier that is used to check for concurrent policy
+      updates. An edited policy should include the same etag so that *set-iam-policy* applies
+      the changes to the correct policy version.
+
+      This command can fail for the following reasons:
+        * The repository specified does not exist.
+        * The active account does not have permission to access the given
+          repository's IAM policies.
+    examples: |
+      To print the IAM policy for repository `my-repo`, run:
+
+        $ {command} my-repo
+
+  request: &request
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        Name of the Artifact Registry repository.

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/list.py

@@ -0,0 +1,118 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2020 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""List Artifact Registry and Container Registry repositories."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.artifacts import flags
+from googlecloudsdk.command_lib.artifacts import util
+
+DEFAULT_LIST_FORMAT = """\
+    table[title="ARTIFACT_REGISTRY"](
+         name.basename():label=REPOSITORY,
+         format:label=FORMAT,
+         mode.basename(undefined=STANDARD_REPOSITORY):label=MODE,
+         description:label=DESCRIPTION,
+         name.segment(3):label=LOCATION,
+         labels.list():label=LABELS,
+         kmsKeyName.yesno(yes='Customer-managed key', no='Google-managed key'):label=ENCRYPTION,
+         createTime.date(tz=LOCAL),
+         updateTime.date(tz=LOCAL),
+         sizeBytes.size(zero='0',precision=3,units_out=M):label="SIZE (MB)"
+    )"""
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA,
+                    base.ReleaseTrack.GA)
+@base.DefaultUniverseOnly
+class List(base.ListCommand):
+  """List repositories in the specified project.
+
+  List all Artifact Registry repositories in the specified project.
+
+  To specify the maximum number of repositories to list, use the --limit flag.
+  """
+
+  detailed_help = {
+      "DESCRIPTION":
+          "{description}",
+      "EXAMPLES":
+          """\
+    The following command lists a maximum of five repositories:
+
+        $ {command} --limit=5
+
+    To list repositories with name as `my_repo`:
+
+        $ {command} --filter='name="projects/my-project/locations/us/repositories/my_repo"'
+
+    To list repositories with a given partial name, use `*` to match any character in name:
+
+        $ {command} --filter='name="projects/my-project/locations/us/repositories/*repo"'
+
+        $ {command} --filter='name="projects/my-project/locations/us/repositories/my_*"'
+
+    To list files that have annotations:
+
+        $ {command} --filter=annotations:*
+
+    To list repositories with annotations pair as [annotation_key: annotation_value]
+
+        $ {command} --filter='annotations.annotation_key:annotation_value'
+
+    To list repositories with annotations containing key as `my_key`:
+
+        $ {command} --filter='annotations.my_key'
+
+    If the key or value contains special characters, such as `my.key` or `my.value`, backtick("`") is required:
+
+        $ {command} --filter='annotations.`my.key`'
+
+        $ {command} --filter='annotations.`my.key`:`my.value`'
+
+    To list repositories with given partial annotation key or value, use `*` to match any character:
+
+        $ {command} --filter='annotations.*key:`*.value`'
+
+    To list repositories ordered by create_time:
+
+        $ {command} --sort-by=create_time
+
+    To list repositories ordered by update_time reversely:
+
+        $ {command}--sort-by=~update_time
+    """,
+  }
+
+  @staticmethod
+  def Args(parser):
+    parser.display_info.AddFormat(DEFAULT_LIST_FORMAT)
+    base.URI_FLAG.RemoveFromParser(parser)
+    flags.GetOptionalLocationFlag().AddToParser(parser)
+
+  def Run(self, args):
+    """This is what gets called when the user runs this command.
+
+    Args:
+      args: an argparse namespace. All the arguments that were provided to this
+        command invocation.
+
+    Returns:
+      A list of Repositories.
+    """
+    return util.ListRepositories(args)

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/list_cleanup_policies.yaml

@@ -0,0 +1,36 @@
+- release_tracks: [GA]
+  universe_compatible: false
+
+  help_text:
+    brief: |
+      List cleanup policies of an Artifact Registry repository.
+    description: |
+      List cleanup policies of an Artifact Registry repository.
+
+      This command can fail for the following reasons:
+        * The specified repository does not exist.
+        * The active account does not have permission to list cleanup policies.
+
+    examples: |
+      To list cleanup policies for the repository `my-repo`, run:
+
+         $ {command} my-repo
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The parent Artifact Registry repository for the list of cleanup policies.
+
+  command_type: DESCRIBE
+  request:
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.artifacts.util:AppendParentInfoToListPackagesResponse
+    - googlecloudsdk.command_lib.artifacts.cleanup_policy_util:RepositoryToCleanupPoliciesResponse
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/remove_iam_policy_binding.yaml

@@ -0,0 +1,34 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief:  |
+      Remove an IAM policy binding from the IAM policy of an Artifact Registry repository.
+    description: |
+      *{command}* removes an IAM policy binding from the IAM policy of an Artifact Registry
+      repository. One binding consists of a member, a role, and an optional condition.
+
+      This command can fail for the following reasons:
+        * The repository specified does not exist.
+        * The active account does not have permission to access the given
+          repository's IAM policies.
+    examples: |
+      To remove an IAM policy binding for the role of 'roles/editor' for the user
+      'test-user@gmail.com' with repository 'my-repo', run:
+
+        $ {command} my-repo --member='user:test-user@gmail.com' --role='roles/editor'
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of
+      policy role and member types.
+
+  request: &request
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        Name of the Artifact Registry repository.
+
+  iam:
+    enable_condition: true

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/set_cleanup_policies.yaml

@@ -0,0 +1,68 @@
+- release_tracks: [GA]
+  universe_compatible: false
+
+  help_text:
+    brief: |
+      Set or update cleanup policies for an Artifact Registry repository.
+    description: |
+      Set or update cleanup policies for an Artifact Registry repository.
+
+      This command can fail for the following reasons:
+        * The given repository does not exist.
+        * The active account does not have permission to update repositories.
+        * A valid cleanup policy format was not provided.
+        * The repository exceeds the maximum number of cleanup policies.
+
+      See https://cloud.google.com/artifact-registry/docs/repositories/cleanup-policy
+      for details of the cleanup policy file format and contents.
+
+    examples: |
+      To create a cleanup policy from a file with the name `policy.json` in the
+      repository `my-repo`, run:
+
+        $ {command} my-repo --policy=policy.json
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The parent Artifact Registry repository for the list of cleanup policies.
+
+    params:
+    - group:
+        required: true
+        params:
+        - arg_name: dry-run
+          api_field: repository.cleanupPolicyDryRun
+          type: bool
+          default: null
+          help_text: |
+            Disable deleting images according to cleanup policies.
+        - arg_name: policy
+          api_field: repository.cleanupPolicies
+          type: googlecloudsdk.command_lib.artifacts.cleanup_policy_util:ParseCleanupPolicy
+          help_text: |
+            Path to a local JSON formatted file containing valid cleanup policies.
+    - arg_name: overwrite
+      help_text: |
+        Delete existing policies and replace with the specified set of policies.
+      hidden: true
+      action:
+        deprecated:
+          removed: true
+          error: Flag {flag_name} is obsolete and should be omitted.
+
+  command_type: UPDATE
+  request:
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+
+  update:
+    read_modify_update: true
+
+  response:
+    modify_response_hooks:
+    - googlecloudsdk.command_lib.artifacts.cleanup_policy_util:RepositoryToCleanupPoliciesResponse
+
+  output:
+    format: json

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/set_iam_policy.yaml

@@ -0,0 +1,30 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: |
+      Set the IAM policy for an Artifact Registry repository.
+    description: |
+      Set the IAM policy associated with an Artifact Registry repository.
+
+      This command can fail for the following reasons:
+        * The repository specified does not exist.
+        * The active account does not have permission to access the given
+          repository's IAM policies.
+
+    examples: |
+      To set the IAM policy for `my-repository`, run:
+
+        $ {command} my-repo policy.json
+
+      See https://cloud.google.com/iam/docs/managing-policies for details of the
+      policy file format and contents.
+
+  request: &request
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        Name of the Artifact Registry repository.

gcloud auth application-default login/google-cloud-sdk/lib/surface/artifacts/repositories/update.yaml

@@ -0,0 +1,172 @@
+- release_tracks: [GA]
+
+  help_text:
+    brief: |
+      Update an Artifact Registry repository.
+    description: |
+      Update the description or labels for an Artifact Registry repository.
+
+      This command can fail for the following reasons:
+        * A repository with this name does not exist.
+        * The active account does not have permission to update repositories.
+    examples: |
+      To update a repository with the name `my-repo` under the current project, run:
+
+        $ {command} my-repo --description="New description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The Artifact Registry repository to update.
+    params:
+    - arg_name: description
+      api_field: repository.description
+      help_text: |
+        Description for the repository.
+    - arg_name: immutable-tags
+      type: bool
+      default: null
+      api_field: repository.dockerConfig.immutableTags
+      help_text: |
+        (Docker only) Prevent changes to tagged images in the repository. Tags cannot be deleted or moved to a different image digest, and tagged images cannot be deleted.
+    - arg_name: remote-username
+      api_field: repository.remoteRepositoryConfig.upstreamCredentials.usernamePasswordCredentials.username
+      default: null
+      help_text: |
+        Remote Repository upstream registry username.
+    - arg_name: remote-password-secret-version
+      api_field: repository.remoteRepositoryConfig.upstreamCredentials.usernamePasswordCredentials.passwordSecretVersion
+      default: null
+      help_text: |
+        Secret Manager secret version that contains password for the remote repository upstream.
+    - group:
+        mutex: true
+        params:
+        - arg_name: allow-vulnerability-scanning
+          api_field: repository.vulnerabilityScanningConfig.enablementConfig
+          default: null
+          action: store_true
+          help_text: |
+            Allow vulnerability scanning on the repository.
+          choices:
+          - arg_value: true
+            enum_value: INHERITED
+            help_text: Vulnerability scanning enablement config set to inherited.
+        - arg_name: disable-vulnerability-scanning
+          api_field: repository.vulnerabilityScanningConfig.enablementConfig
+          default: null
+          action: store_true
+          help_text: |
+            Disable vulnerability scanning on the repository.
+          choices:
+          - arg_value: true
+            enum_value: DISABLED
+            help_text: Vulnerability scanning enablement config set to disabled.
+    - arg_name: disable-remote-validation
+      type: bool
+      api_field: repository.remoteRepositoryConfig.disableUpstreamValidation
+      default: null
+      help_text: |
+        Do not make an HTTP request to validate the remote upstream. Not recommended when setting a custom remote upstream unless you are absolutely sure your upstream URI and any auth is valid.
+    - arg_name: enable-ingestion-attestation
+      api_field: repository.remoteRepositoryConfig.enableIngestionAttestation
+      action: store_true
+      hidden: true
+      default: null
+      type: bool
+      help_text: |
+        Enable generating attestation with verifiable signature on imported files in remote repositories.
+    - arg_name: alternative-hostname
+      api_field: repository.networkConfig.alternativeHostname
+      hidden: true
+      default: null
+      help_text: |
+        An alternative hostname that a repository can be accessed through.
+    - arg_name: alternative-hostname-path-prefix
+      api_field: repository.networkConfig.prefix
+      hidden: true
+      default: null
+      help_text: |
+        An alternative hostname path prefix that a repository can be accessed through.
+    - arg_name: alternative-hostname-default
+      api_field: repository.networkConfig.isDefault
+      hidden: true
+      default: null
+      help_text: |
+        Whether this is the default repository for the alternative hostname if no repository matches the path prefix.
+    - group:
+        mutex: true
+        hidden: true
+        params:
+        - arg_name: allow-sbom-generation
+          api_field: repository.sbomConfig.enablementConfig
+          default: null
+          action: store_true
+          hidden: true
+          help_text: |
+            Allow SBOM generation on the repository.
+          choices:
+          - arg_value: true
+            enum_value: INHERITED
+            help_text: SBOM generation enablement config set to inherited.
+        - arg_name: disable-sbom-generation
+          api_field: repository.sbomConfig.enablementConfig
+          default: null
+          action: store_true
+          hidden: true
+          help_text: |
+            Disable SBOM generation on the repository.
+          choices:
+          - arg_value: true
+            enum_value: DISABLED
+            help_text: SBOM generation enablement config set to disabled.
+    labels:
+      api_field: repository.labels
+    additional_arguments_hook: googlecloudsdk.command_lib.artifacts.util:UpstreamsArgs
+
+  request:
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+    modify_request_hooks:
+    - googlecloudsdk.command_lib.artifacts.util:AppendUpstreamPoliciesToRequest
+
+
+  update:
+    read_modify_update: true
+
+- release_tracks: [ALPHA, BETA]
+
+  help_text:
+    brief: |
+      Update an Artifact Registry repository.
+    description: |
+      Update the description or labels for an Artifact Registry repository.
+
+      This command can fail for the following reasons:
+        * A repository with this name does not exist.
+        * The active account does not have permission to update repositories.
+    examples: |
+      To update a repository with the name `my-repo` under the current project, run:
+
+        $ {command} my-repo --description="New description"
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.artifacts.resources:repository_without_property
+      help_text: |
+        The Artifact Registry repository to update.
+    params:
+    - arg_name: description
+      api_field: repository.description
+      help_text: |
+        Description for the repository.
+    labels:
+      api_field: repository.labels
+
+  request:
+    api_version: v1
+    collection: artifactregistry.projects.locations.repositories
+
+  update:
+    read_modify_update: true