feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/__init__.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Cloud Security Command Center (SCC) artifact guard."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+@base.DefaultUniverseOnly
+
+
+class ArtifactGuards(base.Group):
+  """Manage Cloud Security Command Center (SCC) artifact guard."""
+
+  category = base.SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/connectors/__init__.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Cloud Security Command Center (SCC) artifact guard connectors."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+@base.DefaultUniverseOnly
+
+
+class Connectors(base.Group):
+  """Manage Cloud Security Command Center (SCC) artifact guard connectors."""
+
+  category = base.SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/connectors/create.yaml

@@ -0,0 +1,45 @@
+release_tracks: [ALPHA]
+hidden: true
+help_text:
+  brief: Create a new artifact guard connector.
+  description: |
+    Create a new artifact guard connector. Connectors are tags for images. When passed from CI
+    pipeline to the Artifact Guard service, it is used to decide which policies need to be run
+    against the image being built in the CI pipeline.
+  examples: |
+    Create a connector with full name:
+
+      $ {command} organizations/123/locations/global/connectors/my-connector \
+          --pipeline-type=GOOGLE_CLOUD_BUILD --display-name="My Connector" \
+          --description="This is my connector."
+
+    Create a connector with connector ID:
+
+      $ {command} my-connector --location=global --organization=123 \
+          --pipeline-type=GOOGLE_CLOUD_BUILD --display-name="My Connector" \
+          --description="This is my connector."
+
+request:
+  collection: artifactscanguard.organizations.locations.connectors
+  api_version: v1alpha
+  method: create
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.scc.resources:connector
+    help_text: |
+      The full name of the connector to create. For example:
+      `organizations/123/locations/global/connectors/myConnector`
+  params:
+  - arg_name: pipeline-type
+    api_field: connector.pipelineType
+    required: true
+    help_text: |
+      The type of pipeline for which connector is being created.
+  - arg_name: display-name
+    api_field: connector.displayName
+    help_text: |
+      User-specified name of the connector.
+  - arg_name: description
+    api_field: connector.description
+    help_text: |
+      Description of the connector.

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/connectors/delete.yaml

@@ -0,0 +1,21 @@
+release_tracks: [ALPHA]
+hidden: true
+help_text:
+  brief: Delete an artifact guard connector.
+  description: |
+    Delete an artifact guard connector for a given connector name.
+  examples: |
+    To delete a connector named `organizations/123/locations/global/connectors/myConnector`:
+      $ {command} organizations/123/locations/global/connectors/myConnector
+      OR
+      $ {command} myConnector --location=global --organization=123
+request:
+  collection: artifactscanguard.organizations.locations.connectors
+  api_version: v1alpha
+  method: delete
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.scc.resources:connector
+    help_text: |
+      The full name of the connector to delete. For example:
+      `organizations/123/locations/global/connectors/myConnector`

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/connectors/describe.yaml

@@ -0,0 +1,21 @@
+release_tracks: [ALPHA]
+hidden: true
+help_text:
+  brief: Describe an artifact guard connector.
+  description: |
+    Describe an artifact guard connector for a given connector name.
+  examples: |
+    To describe a connector named `organizations/123/locations/global/connectors/myConnector`:
+      $ {command} organizations/123/locations/global/connectors/myConnector
+      OR
+      $ {command} myConnector --location=global --organization=123
+request:
+  collection: artifactscanguard.organizations.locations.connectors
+  api_version: v1alpha
+  method: get
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.scc.resources:connector
+    help_text: |
+      The full name of the connector to describe. For example:
+      organizations/123/locations/global/connectors/myConnector

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/connectors/list.yaml

@@ -0,0 +1,22 @@
+release_tracks: [ALPHA]
+hidden: true
+help_text:
+  brief: List artifact guard connectors.
+  description: |
+    List artifact guard connectors for a given parent.
+  examples: |
+    To list connectors for `organizations/123/locations/global`:
+      $ {command} organizations/123/locations/global
+request:
+  collection: artifactscanguard.organizations.locations.connectors
+  disable_resource_check: true
+  api_version: v1alpha
+  method: list
+arguments:
+  params:
+  - arg_name: parent
+    api_field: parent
+    is_positional: true
+    required: true
+    help_text: |
+      The parent, which owns this collection of connectors. Format: organizations/{organization}/locations/{location}

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/operations/__init__.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Cloud Security Command Center (SCC) artifact guard operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+@base.DefaultUniverseOnly
+
+
+class Operations(base.Group):
+  """Manage Cloud Security Command Center (SCC) artifact guard operations."""
+
+  category = base.SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/operations/describe.yaml

@@ -0,0 +1,22 @@
+release_tracks: [ALPHA]
+hidden: true
+help_text:
+  brief: |
+    Describe an artifact guard operation.
+  description: |
+    Returns the details of an artifact guard operation for a given operation name.
+  examples: |
+    To describe an operation named "organizations/123/locations/global/operations/myOperation",
+      $ {command} organizations/123/locations/global/operations/myOperation
+
+request:
+  collection: artifactscanguard.organizations.locations.operations
+  api_version: v1alpha
+  method: get
+
+arguments:
+  resource:
+    spec: !REF googlecloudsdk.command_lib.scc.resources:artifact_scan_guard_operation
+    help_text: |
+      The full name of the operation to describe. For example:
+      `organizations/123/locations/global/operations/myOperation`

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/policies/__init__.py

@@ -0,0 +1,32 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Cloud Security Command Center (SCC) artifact guard policies."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+@base.Hidden
+@base.DefaultUniverseOnly
+
+
+class Policies(base.Group):
+  """Manage Cloud Security Command Center (SCC) artifact guard policies."""
+
+  category = base.SECURITY_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/policies/create.yaml

@@ -0,0 +1,39 @@
+- release_tracks: [ALPHA]
+  hidden: true
+  help_text:
+    brief: |
+      Create a new artifact guard policy.
+    description: |
+      Create a new artifact policy, which is used to guardrail the vulnerabilities that can
+      be present in an artifact. Each policy has two defining components:
+      1. Policy Definition: The various rules a given image must adhere to. For this release, the
+        policy definition is limited to a list of allowed vulnerabilities.
+      2. Scope: This defines the resources that the policy will be applied to. For this release, the
+        scope is limited to pipeline type.
+    examples: |
+      Create a policy with full name:
+      $ {command} organizations/123/locations/global/policies/my-policy --policy-file-path=/usr/local/home/user/policy.yaml
+
+      Create a policy with policy id:
+      $ {command} my-policy --policy-file-path=/usr/local/home/user/policy.yaml --location=global --organization=123
+
+  request:
+    collection: artifactscanguard.organizations.locations.policies
+    api_version: v1alpha
+    method: create
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.scc.resources:policy
+      help_text: |
+        The full name of the policy to create. For example:
+        organizations/123/locations/global/policies/myPolicy
+
+    params:
+    - arg_name: policy-file-path
+      api_field: policy
+      required: true
+      type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+      processor: googlecloudsdk.core.yaml:load
+      help_text: |
+        YAML file containing the body of the policy to be created.

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/policies/delete.yaml

@@ -0,0 +1,30 @@
+- release_tracks: [ALPHA]
+  hidden: true
+  help_text:
+    brief: |
+      Delete an artifact guard policy.
+    description: |
+      Delete an artifact guard policy for a given policy name. A policy in active state cannot be deleted.
+    examples: |
+      To delete a policy named "organizations/123/locations/global/policies/myPolicy",
+        $ {command} organizations/123/locations/global/policies/myPolicy
+        OR
+        $ {command} myPolicy --location=global --organization=123
+
+  request:
+    collection: artifactscanguard.organizations.locations.policies
+    api_version: v1alpha
+    method: delete
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.scc.resources:policy
+      help_text: |
+        The full name of the policy to create. For example:
+        organizations/123/locations/global/policies/myPolicy
+
+    params:
+    - arg_name: etag
+      api_field: etag
+      help_text: |
+        The etag of the policy to delete.

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/policies/describe.yaml

@@ -0,0 +1,24 @@
+- release_tracks: [ALPHA]
+  hidden: true
+  help_text:
+    brief: |
+      Describe an artifact guard policy.
+    description: |
+      Returns the details of an artifact guard policy for a given policy name.
+    examples: |
+      To describe a policy named "organizations/123/locations/global/policies/myPolicy",
+        $ {command} organizations/123/locations/global/policies/myPolicy
+        OR
+        $ {command} myPolicy --location=global --organization=123
+
+  request:
+    collection: artifactscanguard.organizations.locations.policies
+    api_version: v1alpha
+    method: get
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.scc.resources:policy
+      help_text: |
+        The full name of the policy to create. For example:
+        organizations/123/locations/global/policies/myPolicy

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/policies/list.yaml

@@ -0,0 +1,25 @@
+- release_tracks: [ALPHA]
+  hidden: true
+  help_text:
+    brief: |
+      List artifact guard policies.
+    description: |
+      Returns the list of policies for a given organization.
+    examples: |
+      To list the policies for  "organizations/123/locations/global",
+        $ {command} organizations/123/locations/global
+
+  request:
+    collection: artifactscanguard.organizations.locations.policies
+    disable_resource_check: true
+    api_version: v1alpha
+    method: list
+
+  arguments:
+    params:
+    - arg_name: parent
+      api_field: parent
+      is_positional: true
+      required: true
+      help_text: |
+        The parent, which owns this collection of policies. Format: organizations/{organization}/locations/{location}

gcloud auth application-default login/google-cloud-sdk/lib/surface/scc/artifact_guard/policies/update.yaml

@@ -0,0 +1,55 @@
+- release_tracks: [ALPHA]
+  hidden: true
+  help_text:
+    brief: |
+      Update an existing artifact guard policy.
+    description: |
+      Updates an existing artifact guard policy.
+      Update Mask: It updates the policy with the fields specified in the update mask.
+      If the update mask is not specified or is set to "*", all the fields are updated.
+      Partial field updates are not supported. The following fields are supported:
+      - "display_name"
+      - "description"
+      - "scope"
+      - "enablement_state"
+      - "vulnerability_policy"
+      - "annotations"
+
+      Allow missing: If set, the policy will be created if it does not exist.
+    examples: |
+      To update a policy named "organizations/123/locations/global/policies/myPolicy",
+        $ {command} organizations/123/locations/global/policies/myPolicy --policy-file-path=policy.yaml
+        OR
+        $ {command} myPolicy --location=global --organization=123 --policy-file-path=policy.yaml
+
+  request:
+    collection: artifactscanguard.organizations.locations.policies
+    api_version: v1alpha
+    method: patch
+
+  arguments:
+    resource:
+      spec: !REF googlecloudsdk.command_lib.scc.resources:policy
+      help_text: |
+        The full name of the policy to update. For example:
+        organizations/123/locations/global/policies/myPolicy
+
+    params:
+    - arg_name: policy-file-path
+      api_field: policy
+      required: true
+      type: "googlecloudsdk.calliope.arg_parsers:FileContents:"
+      processor: googlecloudsdk.core.yaml:load
+      help_text: |
+        YAML file containing the body of the policy to be created.
+
+    - arg_name: update-mask
+      api_field: updateMask
+      help_text: |
+        The list of fields to update. Eg: "description,display_name"
+
+    - arg_name: allow-missing
+      api_field: allowMissing
+      type: bool
+      help_text: |
+        If set, the policy will be created if it does not exist.