feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/__init__.py

@@ -0,0 +1,30 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The source-manager command group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class SourceManagerAlpha(base.Group):
+  """Manage Secure Source Manager resources."""
+  category = base.CI_CD_CATEGORY

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The source-manager instances sub-group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class SourceManagerInstancesAlpha(base.Group):
+  """Manage Secure Source Manager instances."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/add_iam_policy_binding.yaml

@@ -0,0 +1,24 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Add an IAM policy binding to a Secure Source Manager instance.
+  description: Add an IAM policy binding to a Secure Source Manager instance.
+
+  examples: |
+    To add an IAM policy binding for the role of 'roles/editor' for the user 'test-user@gmail.com'
+    with instance named 'my-instance' and location 'us-central1', run:
+
+      $ {command} my-instance --region='us-central1' --member='user:test-user@gmail.com' --role='roles/editor'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of policy role and member types.
+
+request:
+  api_version: v1
+  collection: securesourcemanager.projects.locations.instances
+
+arguments:
+  resource:
+    help_text: The instance for which to add the IAM policy binding.
+    spec: !REF googlecloudsdk.command_lib.source_manager.resources:instance
+
+iam:
+  enable_condition: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/create.py

@@ -0,0 +1,123 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Secure Source Manager create instance command module."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import datetime
+
+from googlecloudsdk.api_lib.securesourcemanager import instances
+from googlecloudsdk.api_lib.services import exceptions
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.source_manager import flags
+from googlecloudsdk.command_lib.source_manager import resource_args
+from googlecloudsdk.core import log
+
+DETAILED_HELP = {
+    'DESCRIPTION':
+        """
+          Create a Secure Source Manager instance.
+        """,
+    'EXAMPLES':
+        """
+            To create a Secure Source Manager instance named 'my-instance' in location 'us-central1' asynchronously, run:
+
+            $ {command} my-instance --region=us-central1
+
+            To create a Secure Source Manager instance named 'my-instance' in location 'us-central1' synchronously, and wait a maximum of 30 minutes for it to finish being created, run:
+
+            $ {command} my-instance --region=us-central1 --no-async --max-wait=30m
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Create(base.CreateCommand):
+  """Create a Secure Source Manager instance."""
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddInstanceResourceArg(parser, 'to create')
+    flags.AddKmsKey(parser)
+    flags.AddPrivateConfigGroup(parser)
+    flags.AddEnableWorkforceIdentityFederation(parser)
+    flags.AddMaxWait(parser, '60m')  # Default to 60 minutes wait.
+    # Create --async flag and set default to be true.
+    base.ASYNC_FLAG.AddToParser(parser)
+    base.ASYNC_FLAG.SetDefault(parser, True)
+
+  def Run(self, args):
+    is_async = args.async_
+    max_wait = datetime.timedelta(seconds=args.max_wait)
+    kms_key = args.kms_key
+    is_private = args.is_private
+    ca_pool = args.ca_pool
+    enable_workforce_identity_federation = (
+        args.enable_workforce_identity_federation
+    )
+    psc_allowed_projects = []
+    if args.IsSpecified('psc_allowed_projects'):
+      psc_allowed_projects = args.psc_allowed_projects
+
+    # Get a long-running operation for this creation
+    client = instances.InstancesClient()
+    instance = args.CONCEPTS.instance.Parse()
+
+    try:
+      operation = client.Create(
+          instance_ref=instance,
+          kms_key=kms_key,
+          is_private=is_private,
+          ca_pool=ca_pool,
+          enable_workforce_identity_federation=enable_workforce_identity_federation,
+          psc_allowed_projects=psc_allowed_projects,
+      )
+    except exceptions.EnableServiceException:
+      # Display a message indicating the special invitation only status of SSM
+      # upon failure to enable the service.
+      log.warning(
+          'Secure Source Manager API (securesourcemanager.googleapis.com) has'
+          ' not been enabled on the project. Secure Source Manager is generally'
+          ' available (GA) by invitation only. To use Secure Source Manager,'
+          ' contact your Google Account team.'
+      )
+      raise
+
+    log.status.Print('Create request issued for [{}].'
+                     .format(instance.instancesId))
+
+    # Return an in-progress operation if async is requested.
+    if is_async:
+      # Create operations have no format by default,
+      # but here we want the operation metadata to be printed.
+      if not args.IsSpecified('format'):
+        args.format = 'default'
+      return operation
+
+    # Return a progress tracker in synchronous mode
+    return client.WaitForOperation(
+        operation_ref=client.GetOperationRef(operation),
+        message='Waiting for operation [{}] to complete'
+        .format(
+            client.GetOperationRef(operation).RelativeName()),
+        max_wait=max_wait)
+
+
+Create.detailed_help = DETAILED_HELP

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/delete.py

@@ -0,0 +1,93 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Secure Source Manager delete instance command module."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+import datetime
+
+from googlecloudsdk.api_lib.securesourcemanager import instances
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.source_manager import flags
+from googlecloudsdk.command_lib.source_manager import resource_args
+from googlecloudsdk.core import log
+
+DETAILED_HELP = {
+    'DESCRIPTION':
+        """
+          Delete a Secure Source Manager instance.
+        """,
+    'EXAMPLES':
+        """
+            To delete a Secure Source Manager instance named 'my-instance' in location 'us-central1' asynchronously, run:
+
+            $ {command} my-instance --region=us-central1
+
+            To delete a Secure Source Manager instance named 'my-instance' in location 'us-central1' synchronously, and wait a maximum of 30 minutes for it to finish being deleted, run:
+
+            $ {command} my-instance --region=us-central1 --no-async --max-wait=30m
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Delete(base.DeleteCommand):
+  """Delete a Secure Source Manager instance."""
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddInstanceResourceArg(parser, 'to delete')
+    flags.AddMaxWait(parser, '60m')  # Default to 60 minutes max wait.
+    # Create a --async flag and set default to be true.
+    base.ASYNC_FLAG.AddToParser(parser)
+    base.ASYNC_FLAG.SetDefault(parser, True)
+
+  def Run(self, args):
+    # Get --async and --max-wait flags.
+    is_async = args.async_
+    max_wait = datetime.timedelta(seconds=args.max_wait)
+
+    # Get a long-running operation for this deletion.
+    client = instances.InstancesClient()
+    instance = args.CONCEPTS.instance.Parse()
+    operation = client.Delete(instance_ref=instance)
+
+    log.status.Print('Delete request issued for [{}].'
+                     .format(instance.instancesId))
+
+    # Return the in-progress operation if async is requested.
+    if is_async:
+      # Delete operations have no format by default,
+      # but here we want the operation metadata to be printed.
+      if not args.IsSpecified('format'):
+        args.format = 'default'
+      return operation
+
+    # Return a progress tracker in synchronous mode.
+    # Set has_result to be false as a deletion process returns nothing.
+    return client.WaitForOperation(
+        operation_ref=client.GetOperationRef(operation),
+        message='Waiting for operation [{}] to complete'
+        .format(
+            client.GetOperationRef(operation).RelativeName()),
+        has_result=False,
+        max_wait=max_wait)
+
+Delete.detailed_help = DETAILED_HELP

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/describe.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Describe a Secure Source Manager instance
+    description: Get details of a Secure Source Manager instance.
+    examples: |
+      To describe a Secure Source Manager instance named 'my-instance' in location 'us-central1' under the current project, run:
+
+      $ {command} my-instance --region=us-central1
+
+  request:
+    api_version: v1
+    collection: securesourcemanager.projects.locations.instances
+
+  arguments:
+    resource:
+      help_text: The instance you want to describe.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:instance

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/get_iam_policy.yaml

@@ -0,0 +1,17 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Get the IAM policy for a Secure Source Manager instance.
+    description: Get the IAM policy for a Secure Source Manager instance.
+    examples: |
+      To get the IAM policy for an instance named 'my-instance' in location 'us-central1', run:
+
+        $ {command} my-instance --region=us-central1
+
+  request:
+    collection: securesourcemanager.projects.locations.instances
+
+  arguments:
+    resource:
+      help_text: The Secure Source Manager instance for which to get the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:instance

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/list.yaml

@@ -0,0 +1,32 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List Secure Source Manager instances
+    description: List all instances on your Secure Source Manager.
+    examples: |
+      To list all Secure Source Manager instances in location 'us-central1' under the current project, run:
+
+      $ {command} --region=us-central1
+
+  request:
+    api_version: v1
+    collection: securesourcemanager.projects.locations.instances
+
+  arguments:
+    resource:
+      help_text: The location you want to list the instances for.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:location
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+      table(
+        name.basename():label=INSTANCE_ID:sort=2,
+        name.segment(3):label=LOCATION,
+        state,
+        createTime.date(),
+        updateTime.date(),
+        hostConfig.html:label=HTML_HOST
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/remove_iam_policy_binding.yaml

@@ -0,0 +1,24 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Remove an IAM policy binding to a Secure Source Manager instance.
+  description: Remove an IAM policy binding to a Secure Source Manager instance.
+
+  examples: |
+    To remove an IAM policy binding for the role of 'roles/editor' for the user 'test-user@gmail.com'
+    with instance named 'my-instance' and location 'us-central1', run:
+
+      $ {command} my-instance --region='us-central1' --member='user:test-user@gmail.com' --role='roles/editor'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of policy role and member types.
+
+request:
+  api_version: v1
+  collection: securesourcemanager.projects.locations.instances
+
+arguments:
+  resource:
+    help_text: The instance for which to remove the IAM policy binding.
+    spec: !REF googlecloudsdk.command_lib.source_manager.resources:instance
+
+iam:
+  enable_condition: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/instances/set_iam_policy.yaml

@@ -0,0 +1,17 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Set the IAM policy for a Secure Source Manager instance.
+    description: Set the IAM policy for a Secure Source Manager instance.
+    examples: |
+      To set the IAM policy for an instance named 'my-instance' in location 'us-central' to content of policy.json , run:
+
+        $ {command} my-instance --region=us-central1 policy.json
+
+  request:
+    collection: securesourcemanager.projects.locations.instances
+
+  arguments:
+    resource:
+      help_text: The Secure Source Manager instance for which to set the IAM policy.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:instance

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/locations/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Secure Source Manager locations sub-group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class SourceManagerLocationsAlpha(base.Group):
+  """Manage Secure Source Manager locations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/locations/list.yaml

@@ -0,0 +1,28 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List Secure Source Manager locations
+    description: List all locations where Secure Source Manager is available.
+    examples: |
+      To list all locations where Secure Source Manager is available for the current project, run:
+
+      $ {command}
+
+  request:
+    api_version: v1
+    collection: securesourcemanager.projects.locations
+
+  arguments:
+    resource:
+      help_text: The project you want to list the locations for.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:project
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+      table(
+        locationId,
+        name.segment(3):label=NAME
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/operations/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2022 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Secure Source Manager operations sub-group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class SourceManagerOperationsAlpha(base.Group):
+  """Manage Secure Source Manager operations."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/operations/describe.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Describe a Secure Source Manager operation
+    description: Get details of a Secure Source Manager operation.
+    examples: |
+      To describe a Secure Source Manager operation named 'my-operation' in location 'us-central1' under the current project, run:
+
+      $ {command} my-operation --region=us-central1
+
+  request:
+    api_version: v1
+    collection: securesourcemanager.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The operation you want to describe.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:operation

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/operations/list.yaml

@@ -0,0 +1,33 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: List Secure Source Manager operations
+    description: List all Secure Source Manager operations.
+    examples: |
+      To list all Secure Source Manager operations in location 'us-central1' under the current project, run:
+
+      $ {command} --region=us-central1
+
+  request:
+    api_version: v1
+    collection: securesourcemanager.projects.locations.operations
+
+  arguments:
+    resource:
+      help_text: The location you want to list the operations for.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:location
+
+  response:
+    id_field: name
+
+  output:
+    format: |
+      table(
+        name.basename():label=OPERATION_NAME,
+        name.segment(3):label=REGION,
+        metadata.verb:label=TYPE,
+        metadata.target.basename(),
+        done,
+        metadata.createTime.date():sort=1,
+        duration(start=metadata.createTime,end=metadata.endTime,precision=0,calendar=false).slice(2:).join("").yesno(no="<1S"):label=DURATION
+      )

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/__init__.py

@@ -0,0 +1,29 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The Secure Source Manager repositories sub-group."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class SourceManagerReposAlpha(base.Group):
+  """Manage Secure Source Manager repositories."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/add_iam_policy_binding.yaml

@@ -0,0 +1,25 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Add an IAM policy binding to a Secure Source Manager repository.
+  description: Add an IAM policy binding to a Secure Source Manager repository.
+
+  examples: |
+    To add an IAM policy binding for the Repository Admin role (`roles/securesourcemanager.repoAdmin`)
+    for the user `test-user@gmail.com` in a repository named `my-repo` and location `us-central1`,
+    run the following command:
+
+      $ {command} my-repo --region=us-central1 --member=user:test-user@gmail.com --role=roles/securesourcemanager.repoAdmin
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of policy role and member types.
+
+request:
+  api_version: v1
+  collection: securesourcemanager.projects.locations.repositories
+
+arguments:
+  resource:
+    help_text: Secure Source Manager repository to add the IAM policy binding to.
+    spec: !REF googlecloudsdk.command_lib.source_manager.resources:repository
+
+iam:
+  enable_condition: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/create.py

@@ -0,0 +1,75 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Create Secure Source Manager repository command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.securesourcemanager import repositories
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.source_manager import flags
+from googlecloudsdk.command_lib.source_manager import resource_args
+from googlecloudsdk.core import log
+
+DETAILED_HELP = {
+    "DESCRIPTION": """
+          Create a Secure Source Manager repository.
+        """,
+    "EXAMPLES": """
+            To create a repository called 'my-repo' in location 'us-central1' in
+            instance 'my-instance', run the following command:
+
+            $ {command} my-repo --region=us-central1 --instance=my-instance
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Create(base.CreateCommand):
+  """Create a Secure Source Manager repository."""
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRepositoryResourceArg(parser, "to create")
+    flags.AddInstance(parser)
+    flags.AddDescription(parser)
+    flags.AddInitialConfigGroup(parser)
+
+  def Run(self, args):
+    # Get resource args to contruct base url
+    repository_ref = args.CONCEPTS.repository.Parse()
+
+    # Create a repository
+    client = repositories.RepositoriesClient()
+    # this is a shortcut LRO, it completes immediately and is marked as done
+    # there is no need to wait
+    create_operation = client.Create(
+        repository_ref,
+        args.instance,
+        args.description,
+        args.default_branch,
+        args.gitignores,
+        args.license,
+        args.readme,
+    )
+    log.CreatedResource(repository_ref.RelativeName())
+    return create_operation
+
+
+Create.detailed_help = DETAILED_HELP

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/delete.py

@@ -0,0 +1,65 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Delete Secure Source Manager repository command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.securesourcemanager import repositories
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.source_manager import flags
+from googlecloudsdk.command_lib.source_manager import resource_args
+from googlecloudsdk.core import log
+
+DETAILED_HELP = {
+    "DESCRIPTION": """
+          Delete a Secure Source Manager repository.
+        """,
+    "EXAMPLES": """
+            To delete a repository called `my-repo` in location `us-central1`,
+            run the following command:
+
+            $ {command} my-repo --region=us-central1
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Delete(base.DeleteCommand):
+  """Delete a Secure Source Manager repository."""
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRepositoryResourceArg(parser, "to delete")
+    flags.AddAllowMissing(parser)
+
+  def Run(self, args):
+    # Get resource args to contruct base url
+    repository_ref = args.CONCEPTS.repository.Parse()
+    # Delete repository
+    client = repositories.RepositoriesClient()
+    # this is a shortcut LRO, it completes immediately and is marked as done
+    # there is no need to wait
+    delete_operation = client.Delete(repository_ref, args.allow_missing)
+
+    log.DeletedResource(repository_ref.RelativeName())
+    return delete_operation
+
+
+Delete.detailed_help = DETAILED_HELP

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/describe.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Describe a Secure Source Manager repository.
+    description: Get metadata of a Secure Source Manager repository.
+    examples: |
+      To describe a repository called `my-repo` in location `us-central1`, run the following command:
+
+      $ {command} my-repo --region=us-central1
+
+  request:
+    api_version: v1
+    collection: securesourcemanager.projects.locations.repositories
+
+  arguments:
+    resource:
+      help_text: The Secure Source Manager repository to describe.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:repository

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/get_iam_policy.yaml

@@ -0,0 +1,17 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Get the IAM policy for a Secure Source Manager repository.
+    description: Get the IAM policy for a Secure Source Manager repository.
+    examples: |
+      To get the IAM policy for an repository named `my-repo` in location `us-central1`, run the following command:
+
+        $ {command} my-repo --region=us-central1
+
+  request:
+    collection: securesourcemanager.projects.locations.repositories
+
+  arguments:
+    resource:
+      help_text: Secure Source Manager repository to get the IAM policy from.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:repository

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/list.py

@@ -0,0 +1,71 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2023 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""List Secure Source Manager repositories command."""
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+from googlecloudsdk.api_lib.securesourcemanager import repositories
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.source_manager import flags
+from googlecloudsdk.command_lib.source_manager import resource_args
+
+DETAILED_HELP = {
+    "DESCRIPTION": """
+          List Secure Source Manager repositories.
+        """,
+    "EXAMPLES": """
+            To list repositories in location `us-central1` under instance
+            `my-instance`, run the following command:
+
+            $ {command} --region=us-central1 --instance=my-instance
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class List(base.ListCommand):
+  """List all repositories under a Secure Source Manager instance."""
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRegionResourceArg(parser, "to list")
+    flags.AddInstance(parser)
+    base.FILTER_FLAG.RemoveFromParser(parser)
+    base.SORT_BY_FLAG.RemoveFromParser(parser)
+    base.URI_FLAG.RemoveFromParser(parser)
+
+    parser.display_info.AddFormat("""
+          table(
+            name.basename():label=REPOSITORY_ID:sort=1,
+            name.segment(3):label=LOCATION,
+            instance.basename():label=INSTANCE_ID,
+            createTime.date(),
+            uris.html:label=HTML_HOST
+          )
+        """)
+
+  def Run(self, args):
+    # Get resource args to contruct base url
+    location_ref = args.CONCEPTS.region.Parse()
+
+    # List repositories
+    client = repositories.RepositoriesClient()
+    return client.List(location_ref, args.instance, args.page_size, args.limit)
+
+
+List.detailed_help = DETAILED_HELP

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/remove_iam_policy_binding.yaml

@@ -0,0 +1,25 @@
+release_tracks: [ALPHA, BETA, GA]
+help_text:
+  brief: Remove an IAM policy binding from a Secure Source Manager repository.
+  description: Remove an IAM policy binding to a Secure Source Manager repository.
+
+  examples: |
+    To remove the Repository Admin IAM role (`roles/securesourcemanager.repoAdmin`) binding from the
+    user `test-user@gmail.com` in a repository named `my-repo` and location `us-central1`, run the
+    following command:
+
+      $ {command} my-repo --region=us-central1 --member=user:test-user@gmail.com --role=roles/securesourcemanager.repoAdmin
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of policy role and member types.
+
+request:
+  api_version: v1
+  collection: securesourcemanager.projects.locations.repositories
+
+arguments:
+  resource:
+    help_text: Secure Source Manager repository to remove the IAM policy binding from.
+    spec: !REF googlecloudsdk.command_lib.source_manager.resources:repository
+
+iam:
+  enable_condition: false

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/set_iam_policy.yaml

@@ -0,0 +1,18 @@
+- release_tracks: [ALPHA, BETA, GA]
+
+  help_text:
+    brief: Set the IAM policy for a Secure Source Manager repository.
+    description: Set the IAM policy for a Secure Source Manager repository.
+    examples: |
+      To set the IAM policy for a repository named `my-repo` in location `us-central` to the
+      content of `policy.json` , run the following command:
+
+        $ {command} my-repo --region=us-central1 policy.json
+
+  request:
+    collection: securesourcemanager.projects.locations.repositories
+
+  arguments:
+    resource:
+      help_text: Secure Source Manager repository to set the IAM policy on.
+      spec: !REF googlecloudsdk.command_lib.source_manager.resources:repository

gcloud auth application-default login/google-cloud-sdk/lib/surface/source_manager/repos/update.py

@@ -0,0 +1,86 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2025 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Update Secure Source Manager repository command."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.api_lib.securesourcemanager import repositories
+from googlecloudsdk.calliope import base
+from googlecloudsdk.calliope import exceptions
+from googlecloudsdk.command_lib.source_manager import flags
+from googlecloudsdk.command_lib.source_manager import resource_args
+from googlecloudsdk.core import log
+
+DETAILED_HELP = {
+    "DESCRIPTION": """
+          Update a Secure Source Manager repository.
+        """,
+    "EXAMPLES": """
+            To update the description of a repository called `my-repo` in
+            location `us-central1`, run the following command:
+
+            $ {command} my-repo --description="new description" --region=us-central1
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(
+    base.ReleaseTrack.ALPHA, base.ReleaseTrack.BETA, base.ReleaseTrack.GA
+)
+class Update(base.UpdateCommand):
+  """Update a Secure Source Manager repository."""
+
+  NO_CHANGES_MESSAGE = (
+      "There are no changes to the repository [{repository}] for update"
+  )
+
+  @staticmethod
+  def Args(parser):
+    resource_args.AddRepositoryResourceArg(parser, "to update")
+    flags.AddDescription(parser)
+    flags.AddValidateOnly(parser)
+
+  def Run(self, args):
+    # Get resource args to contruct base url
+    repository_ref = args.CONCEPTS.repository.Parse()
+    # Update repository
+    client = repositories.RepositoriesClient()
+
+    # Collect the list of update masks
+    update_mask = []
+    if args.IsSpecified("description"):
+      update_mask.append("description")
+
+    if not update_mask:
+      raise exceptions.MinimumArgumentException(
+          [
+              "--description",
+          ],
+          self.NO_CHANGES_MESSAGE.format(repository=repository_ref.Name()),
+      )
+
+    # this is a shortcut LRO, it completes immediately and is marked as done
+    # there is no need to wait
+    update_operation = client.Update(
+        repository_ref, update_mask, args.validate_only, args.description
+    )
+    log.UpdatedResource(repository_ref.RelativeName())
+    return update_operation
+
+
+Update.detailed_help = DETAILED_HELP