// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.workloadmanager.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/empty.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.WorkloadManager.V1";
option go_package = "cloud.google.com/go/workloadmanager/apiv1/workloadmanagerpb;workloadmanagerpb";
option java_multiple_files = true;
option java_outer_classname = "WorkloadManagerServiceProto";
option java_package = "com.google.cloud.workloadmanager.v1";
option php_namespace = "Google\\Cloud\\WorkloadManager\\V1";
option ruby_package = "Google::Cloud::WorkloadManager::V1";
option (google.api.resource_definition) = {
  type: "cloudkms.googleapis.com/CryptoKey"
  pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}"
};

// The Workload Manager provides various tools to deploy, validate and observe
// your workloads running on Google Cloud.
service WorkloadManager {
  option (google.api.default_host) = "workloadmanager.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists Evaluations in a given project and location.
  rpc ListEvaluations(ListEvaluationsRequest)
      returns (ListEvaluationsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/evaluations"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single Evaluation.
  rpc GetEvaluation(GetEvaluationRequest) returns (Evaluation) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/evaluations/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new Evaluation in a given project and location.
  rpc CreateEvaluation(CreateEvaluationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/evaluations"
      body: "evaluation"
    };
    option (google.api.method_signature) = "parent,evaluation,evaluation_id";
    option (google.longrunning.operation_info) = {
      response_type: "Evaluation"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates the parameters of a single Evaluation.
  rpc UpdateEvaluation(UpdateEvaluationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{evaluation.name=projects/*/locations/*/evaluations/*}"
      body: "evaluation"
    };
    option (google.api.method_signature) = "evaluation,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "Evaluation"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a single Evaluation.
  rpc DeleteEvaluation(DeleteEvaluationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/evaluations/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists Executions in a given project and location.
  rpc ListExecutions(ListExecutionsRequest) returns (ListExecutionsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/evaluations/*}/executions"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets details of a single Execution.
  rpc GetExecution(GetExecutionRequest) returns (Execution) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/evaluations/*/executions/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new Execution in a given project and location.
  rpc RunEvaluation(RunEvaluationRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{name=projects/*/locations/*/evaluations/*}/executions:run"
      body: "*"
    };
    option (google.api.method_signature) = "name,execution,execution_id";
    option (google.longrunning.operation_info) = {
      response_type: "Execution"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a single Execution.
  rpc DeleteExecution(DeleteExecutionRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/evaluations/*/executions/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists the result of a single evaluation.
  rpc ListExecutionResults(ListExecutionResultsRequest)
      returns (ListExecutionResultsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/evaluations/*/executions/*}/results"
    };
    option (google.api.method_signature) = "parent";
  }

  // Lists rules in a given project.
  rpc ListRules(ListRulesRequest) returns (ListRulesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/rules"
    };
    option (google.api.method_signature) = "parent";
  }

  // List all scanned resources for a single Execution.
  rpc ListScannedResources(ListScannedResourcesRequest)
      returns (ListScannedResourcesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/evaluations/*/executions/*}/scannedResources"
    };
    option (google.api.method_signature) = "parent";
  }
}

// Represents a Workload Manager Evaluation configuration.
// An Evaluation defines a set of rules to be validated against a scope
// of Cloud resources.
message Evaluation {
  option (google.api.resource) = {
    type: "workloadmanager.googleapis.com/Evaluation"
    pattern: "projects/{project}/locations/{location}/evaluations/{evaluation}"
    plural: "evaluations"
    singular: "evaluation"
  };

  // Possible types of workload evaluations like SAP, SQL Server, etc.
  enum EvaluationType {
    // Not specified.
    EVALUATION_TYPE_UNSPECIFIED = 0;

    // SAP best practices.
    SAP = 1;

    // SQL best practices.
    SQL_SERVER = 2;

    // Customized best practices.
    OTHER = 3;
  }

  // Name of resource that has the form
  // `projects/{project_id}/locations/{location_id}/evaluations/{evaluation_id}`.
  string name = 1;

  // Description of the Evaluation.
  string description = 2;

  // Resource filter for an evaluation defining the scope of resources to be
  // evaluated.
  ResourceFilter resource_filter = 3;

  // The names of the rules used for this evaluation.
  repeated string rule_names = 4;

  // Output only. [Output only] The current lifecycle state of the evaluation
  // resource.
  ResourceStatus resource_status = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output only] Create time stamp.
  google.protobuf.Timestamp create_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output only] Update time stamp.
  google.protobuf.Timestamp update_time = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Labels as key value pairs.
  map<string, string> labels = 9;

  // Crontab format schedule for scheduled evaluation, currently only supports
  // the following fixed schedules:
  // * `0 */1 * * *` # Hourly
  // * `0 */6 * * *` # Every 6 hours
  // * `0 */12 * * *` # Every 12 hours
  // * `0 0 */1 * *` # Daily
  // * `0 0 */7 * *` # Weekly
  // * `0 0 */14 * *` # Every 14 days
  // * `0 0 1 */1 *` # Monthly
  optional string schedule = 10;

  // The Cloud Storage bucket name for custom rules.
  string custom_rules_bucket = 11;

  // Evaluation type.
  EvaluationType evaluation_type = 12;

  // Optional. The BigQuery destination for detailed evaluation results.
  // If this field is specified, the results of each evaluation execution are
  // exported to BigQuery.
  BigQueryDestination big_query_destination = 13
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Immutable. Customer-managed encryption key name, in the format
  // projects/*/locations/*/keyRings/*/cryptoKeys/*.
  // The key will be used for CMEK encryption of the evaluation resource.
  string kms_key = 15 [
    (google.api.field_behavior) = IMMUTABLE,
    (google.api.resource_reference) = {
      type: "cloudkms.googleapis.com/CryptoKey"
    }
  ];
}

// Resource filter for an evaluation defining the scope of resources to be
// evaluated.
message ResourceFilter {
  // The scopes of evaluation resource.
  // Format:
  // * `projects/{project_id}`
  // * `folders/{folder_id}`
  // * `organizations/{organization_id}`
  repeated string scopes = 1;

  // The pattern to filter resources by their id
  // For example, a pattern of ".*prod-cluster.*" will match all resources that
  // contain "prod-cluster" in their ID.
  repeated string resource_id_patterns = 2;

  // Labels to filter resources by. Each key-value pair in the map must exist
  // on the resource for it to be included (e.g. VM instance labels).
  // For example, specifying `{ "env": "prod", "database": "nosql" }` will only
  // include resources that have labels `env=prod` and `database=nosql`.
  map<string, string> inclusion_labels = 3;

  // Filter compute engine resources.
  GceInstanceFilter gce_instance_filter = 4;
}

// A filter for matching Compute Engine instances.
message GceInstanceFilter {
  // If non-empty, only Compute Engine instances associated with at least one of
  // the provided service accounts will be included in the evaluation.
  repeated string service_accounts = 4;
}

// The lifecycle status of an Evaluation resource.
message ResourceStatus {
  // Possible states of an evaluation, such as CREATING, ACTIVE, and DELETING.
  enum State {
    // The state has not been populated in this message.
    STATE_UNSPECIFIED = 0;

    // Resource has an active Create operation.
    CREATING = 1;

    // Resource has no outstanding operations on it or has active Update
    // operations.
    ACTIVE = 2;

    // Resource has an active Delete operation.
    DELETING = 3;
  }

  // State of the Evaluation resource.
  State state = 2;
}

// BigQuery destination for evaluation results.
message BigQueryDestination {
  // Optional. Destination dataset to save evaluation results.
  string destination_dataset = 1 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Determines if a new results table will be created when an
  // Execution is created.
  bool create_new_results_table = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for the ListEvaluations RPC.
message ListEvaluationsRequest {
  // Required. Parent value for ListEvaluationsRequest.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "workloadmanager.googleapis.com/Evaluation"
    }
  ];

  // Requested page size. Server may return fewer items than requested.
  // If unspecified, server will pick an appropriate default.
  int32 page_size = 2;

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Filter to be applied when listing the evaluation results.
  string filter = 4;

  // Hint for how to order the results.
  string order_by = 5;
}

// Response message for the ListEvaluations RPC.
message ListEvaluationsResponse {
  // The list of evaluations.
  repeated Evaluation evaluations = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request message for the GetEvaluation RPC.
message GetEvaluationRequest {
  // Required. Name of the resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workloadmanager.googleapis.com/Evaluation"
    }
  ];
}

// Request message for the CreateEvaluation RPC.
message CreateEvaluationRequest {
  // Required. The resource prefix of the evaluation location using the form:
  // `projects/{project_id}/locations/{location_id}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "workloadmanager.googleapis.com/Evaluation"
    }
  ];

  // Required. Id of the requesting object.
  string evaluation_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created.
  Evaluation evaluation = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for the UpdateEvaluation RPC.
message UpdateEvaluationRequest {
  // Required. Field mask is used to specify the fields to be overwritten in the
  // Evaluation resource by the update.
  // The fields specified in the update_mask are relative to the resource, not
  // the full request. A field will be overwritten if it is in the mask.
  google.protobuf.FieldMask update_mask = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being updated.
  Evaluation evaluation = 2 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for the DeleteEvaluation RPC.
message DeleteEvaluationRequest {
  // Required. Name of the resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workloadmanager.googleapis.com/Evaluation"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Followed the best practice from
  // https://aip.dev/135#cascading-delete.
  bool force = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Execution that represents a single run of an Evaluation.
message Execution {
  option (google.api.resource) = {
    type: "workloadmanager.googleapis.com/Execution"
    pattern: "projects/{project}/locations/{location}/evaluations/{evaluation}/executions/{execution}"
    plural: "executions"
    singular: "execution"
  };

  // The possible states of an execution like RUNNING, SUCCEEDED, FAILED, etc.
  enum State {
    // State of execution is unspecified.
    STATE_UNSPECIFIED = 0;

    // The execution is running in backend service.
    RUNNING = 1;

    // The execution run succeeded.
    SUCCEEDED = 2;

    // The execution run failed.
    FAILED = 3;
  }

  // The type of execution, could be on demand execute or scheduled execute.
  enum Type {
    // Type of execution is unspecified.
    TYPE_UNSPECIFIED = 0;

    // Type of execution is one time.
    ONE_TIME = 1;

    // Type of execution is scheduled.
    SCHEDULED = 2;
  }

  // External data sources for an execution.
  message ExternalDataSources {
    // Possible types of external data sources like BigQuery table, etc.
    enum Type {
      // Unknown type.
      TYPE_UNSPECIFIED = 0;

      // BigQuery table.
      BIG_QUERY_TABLE = 1;
    }

    // Optional. Name of external data source. The name will be used inside the
    // rego/sql to refer the external data.
    string name = 1 [(google.api.field_behavior) = OPTIONAL];

    // Required. URI of external data source. example of bq table
    // {project_ID}.{dataset_ID}.{table_ID}.
    string uri = 2 [(google.api.field_behavior) = REQUIRED];

    // Required. Type of external data source.
    Type type = 3 [(google.api.field_behavior) = REQUIRED];

    // Required. The asset type of the external data source.
    // This can be a supported Cloud Asset Inventory asset type
    // (see https://cloud.google.com/asset-inventory/docs/supported-asset-types)
    // to override the default asset type, or it can be a custom type defined by
    // the user.
    string asset_type = 4 [(google.api.field_behavior) = REQUIRED];
  }

  // Additional information generated by an execution.
  message Notice {
    // Output only. Message of the notice.
    string message = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // The engine used for the execution.
  enum Engine {
    // The original CG.
    ENGINE_UNSPECIFIED = 0;

    // SlimCG / Scanner.
    ENGINE_SCANNER = 1;

    // Evaluation Engine V2.
    V2 = 2;
  }

  // Execution summary.
  message Summary {
    // Output only. Number of failures.
    int64 failures = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. Number of new failures compared to the previous execution.
    int64 new_failures = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

    // Output only. Number of new fixes compared to the previous execution.
    int64 new_fixes = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
  }

  // The name of execution resource. The format is
  // projects/{project}/locations/{location}/evaluations/{evaluation}/executions/{execution}.
  string name = 1;

  // Output only. [Output only] Start time stamp.
  google.protobuf.Timestamp start_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output only] End time stamp.
  google.protobuf.Timestamp end_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output only] Inventory time stamp.
  google.protobuf.Timestamp inventory_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output only] State.
  State state = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. [Output only] Evaluation ID.
  string evaluation_id = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Labels as key value pairs.
  map<string, string> labels = 7;

  // Type which represents whether the execution executed directly by user or
  // scheduled according to the `Evaluation.schedule` field.
  Type run_type = 8;

  // Output only. Execution result summary per rule.
  repeated RuleExecutionResult rule_results = 9
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. External data sources.
  repeated ExternalDataSources external_data_sources = 10
      [(google.api.field_behavior) = OPTIONAL];

  // Output only. Additional information generated by the execution.
  repeated Notice notices = 11 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Engine.
  Engine engine = 12 [(google.api.field_behavior) = OPTIONAL];

  // Output only. [Output only] Result summary for the execution.
  Summary result_summary = 13 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Execution result summary per rule.
message RuleExecutionResult {
  // Possible states of a rule execution like SUCCESS, FAILURE, etc.
  enum State {
    // Unknown state
    STATE_UNSPECIFIED = 0;

    // Execution completed successfully
    STATE_SUCCESS = 1;

    // Execution completed with failures
    STATE_FAILURE = 2;

    // Execution was not executed
    STATE_SKIPPED = 3;
  }

  // Rule name as plain text like `sap-hana-configured`.
  string rule = 1;

  // Output only. The execution status.
  State state = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Execution message, if any.
  string message = 3;

  // Number of violations.
  int64 result_count = 4;

  // Number of total scanned resources.
  int64 scanned_resource_count = 5;
}

// Request message for the ListExecutions RPC.
message ListExecutionsRequest {
  // Required. The resource prefix of the Execution using the form:
  // `projects/{project}/locations/{location}/evaluations/{evaluation}`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "workloadmanager.googleapis.com/Execution"
    }
  ];

  // Requested page size. Server may return fewer items than requested.
  // If unspecified, server will pick an appropriate default.
  int32 page_size = 2;

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Filtering results.
  string filter = 4;

  // Field to sort by. See https://google.aip.dev/132#ordering for more details.
  string order_by = 5;
}

// Response message for the ListExecutions RPC.
message ListExecutionsResponse {
  // The list of Execution.
  repeated Execution executions = 1;

  // A token identifying a page of results the server should return.
  string next_page_token = 2;

  // Locations that could not be reached.
  repeated string unreachable = 3;
}

// Request message for the GetExecution RPC.
message GetExecutionRequest {
  // Required. Name of the resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workloadmanager.googleapis.com/Execution"
    }
  ];
}

// Request message for the RunEvaluation RPC.
message RunEvaluationRequest {
  // Required. The resource name of the Evaluation using the form:
  // `projects/{project}/locations/{location}/evaluations/{evaluation}`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workloadmanager.googleapis.com/Evaluation"
    }
  ];

  // Required. ID of the execution which will be created.
  string execution_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The resource being created.
  Execution execution = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes since the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for the DeleteExecution RPC.
message DeleteExecutionRequest {
  // Required. Name of the resource.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "workloadmanager.googleapis.com/Execution"
    }
  ];

  // Optional. An optional request ID to identify requests. Specify a unique
  // request ID so that if you must retry your request, the server will know to
  // ignore the request if it has already been completed. The server will
  // guarantee that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for the ListExecutionResults RPC.
message ListExecutionResultsRequest {
  // Required. The execution results.
  // Format: {parent}/evaluations/*/executions/*/results.
  string parent = 1 [(google.api.field_behavior) = REQUIRED];

  // Requested page size. Server may return fewer items than requested.
  // If unspecified, server will pick an appropriate default.
  int32 page_size = 2;

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Filtering results.
  string filter = 4;
}

// Response message for the ListExecutionResults RPC.
message ListExecutionResultsResponse {
  // The versions from the specified publisher.
  repeated ExecutionResult execution_results = 1;

  // A token, which can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;
}

// The result of an execution.
message ExecutionResult {
  // Enum of execution result type.
  enum Type {
    // Unknown state.
    TYPE_UNSPECIFIED = 0;

    // Resource successfully passed the rule.
    TYPE_PASSED = 1;

    // Resource violated the rule.
    TYPE_VIOLATED = 2;
  }

  // The violation message of an execution.
  string violation_message = 1;

  // The severity of violation.
  string severity = 2;

  // The rule that is violated in an evaluation.
  string rule = 3 [(google.api.resource_reference) = {
    type: "workloadmanager.googleapis.com/Rule"
  }];

  // The URL for the documentation of the rule.
  string documentation_url = 4;

  // The resource that violates the rule.
  Resource resource = 5;

  // The details of violation in an evaluation result.
  ViolationDetails violation_details = 6;

  // The commands to remediate the violation.
  repeated Command commands = 7;

  // Execution result type of the scanned resource.
  Type type = 8;
}

// Command specifies the type of command to execute.
message Command {
  // The type of command.
  oneof command_type {
    // AgentCommand specifies a one-time executable program for the agent to
    // run.
    AgentCommand agent_command = 1;

    // ShellCommand is invoked via the agent's command line executor.
    ShellCommand shell_command = 2;
  }
}

// An AgentCommand specifies a one-time executable program for the agent to run.
message AgentCommand {
  // The name of the agent one-time executable that will be invoked.
  string command = 1;

  // A map of key/value pairs that can be used to specify
  // additional one-time executable settings.
  map<string, string> parameters = 2;
}

// A ShellCommand is invoked via the agent's command line executor.
message ShellCommand {
  // The name of the command to be executed.
  string command = 1;

  // Arguments to be passed to the command.
  string args = 2;

  // Optional. If not specified, the default timeout is 60 seconds.
  int32 timeout_seconds = 3;
}

// The rule output of the violation.
message RuleOutput {
  // Output only. Violation details generated by rule.
  map<string, string> details = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The message generated by rule.
  string message = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// The violation in an evaluation result.
message ViolationDetails {
  // The name of the asset.
  string asset = 1;

  // The service account associated with the resource.
  string service_account = 2;

  // Details of the violation.
  map<string, string> observed = 3;

  // Output only. The rule output of the violation.
  repeated RuleOutput rule_output = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Resource in execution result.
message Resource {
  // The type of resource.
  string type = 1;

  // The name of the resource.
  string name = 2;

  // The service account associated with the resource.
  string service_account = 3;
}

// Represents the metadata of the long-running operation.
message OperationMetadata {
  // Output only. The time the operation was created.
  google.protobuf.Timestamp create_time = 1
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time the operation finished running.
  google.protobuf.Timestamp end_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Server-defined resource path for the target of the operation.
  string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Name of the verb executed by the operation.
  string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Human-readable status of the operation, if any.
  string status_message = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Identifies whether the user has requested cancellation
  // of the operation. Operations that have been cancelled successfully
  // have [Operation.error][] value with a
  // [google.rpc.Status.code][google.rpc.Status.code] of 1, corresponding to
  // `Code.CANCELLED`.
  bool requested_cancellation = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. API version used to start the operation.
  string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// A rule to be evaluated.
message Rule {
  option (google.api.resource) = {
    type: "workloadmanager.googleapis.com/Rule"
    pattern: "projects/{project}/locations/{location}/rules/{rule}"
    plural: "rules"
    singular: "rule"
  };

  // The type of the rule.
  enum RuleType {
    // Not specified.
    RULE_TYPE_UNSPECIFIED = 0;

    // Baseline rules.
    BASELINE = 1;

    // Custom rules.
    CUSTOM = 2;
  }

  // Rule name.
  string name = 1;

  // Output only. The version of the rule.
  string revision_id = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // The name display in UI.
  string display_name = 3;

  // Describe rule in plain language.
  string description = 4;

  // The severity of the rule.
  string severity = 5;

  // The primary category.
  string primary_category = 6;

  // The secondary category.
  string secondary_category = 7;

  // The message template for rule.
  string error_message = 8;

  // The document url for the rule.
  string uri = 9;

  // The remediation for the rule.
  string remediation = 10;

  // List of user-defined tags.
  repeated string tags = 11;

  // The type of the rule.
  RuleType rule_type = 12;

  // The CAI asset type of the rule is evaluating, for joined asset types, it
  // will be the corresponding primary asset types.
  string asset_type = 13;
}

// Request message for the ListRules RPC.
message ListRulesRequest {
  // Required. The [project] on which to execute the request. The format is:
  //     projects/{project_id}/locations/{location}
  // Currently, the pre-defined rules are global available to all projects and
  // all regions.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "workloadmanager.googleapis.com/Rule"
    }
  ];

  // Requested page size. Server may return fewer items than requested.
  // If unspecified, server will pick an appropriate default.
  int32 page_size = 2;

  // A token identifying a page of results the server should return.
  string page_token = 3;

  // Filter based on primary_category, secondary_category.
  string filter = 4;

  // The Cloud Storage bucket name for custom rules.
  string custom_rules_bucket = 5;

  // Optional. The evaluation type of the rules will be applied to.
  // The Cloud Storage bucket name for custom rules.
  Evaluation.EvaluationType evaluation_type = 6
      [(google.api.field_behavior) = OPTIONAL];
}

// Response message for the ListRules RPC.
message ListRulesResponse {
  // All rules in response.
  repeated Rule rules = 1;
}

// Request message for the ListScannedResources RPC.
message ListScannedResourcesRequest {
  // Required. Parent for ListScannedResourcesRequest.
  string parent = 1 [(google.api.field_behavior) = REQUIRED];

  // Rule name.
  string rule = 2;

  // Requested page size. Server may return fewer items than requested.
  // If unspecified, server will pick an appropriate default.
  int32 page_size = 3;

  // A token identifying a page of results the server should return.
  string page_token = 4;

  // Filtering results.
  string filter = 5;

  // Field to sort by. See https://google.aip.dev/132#ordering for more details.
  string order_by = 6;
}

// Response message for the ListScannedResources RPC.
message ListScannedResourcesResponse {
  // All scanned resources in response.
  repeated ScannedResource scanned_resources = 1;

  // A token, which can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  string next_page_token = 2;
}

// A scanned resource.
message ScannedResource {
  // Resource name.
  string resource = 1;

  // Resource type.
  string type = 2;
}