feat: Support per-repository identity for repositories (#34710)

* feat: Support per-repository identity for repositories
feat: Support repository secret scanning with custom DLP inspect templates

PiperOrigin-RevId: 942184869

Source-Link: googleapis/googleapis@ba4573a

Source-Link: googleapis/googleapis-gen@853de32
Copy-Tag: eyJwIjoiZ29vZ2xlLWNsb3VkLXNlY3VyZV9zb3VyY2VfbWFuYWdlci12MS8uT3dsQm90LnlhbWwiLCJoIjoiODUzZGUzMmMzMWM5ZTIyNjYzZGFmNTVlOGQ1NzU4OGQ1NTRkYThhYiJ9

* 🦉 Updates from OwlBot post-processor

See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md

---------

Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>

Author: gcf-owl-bot[bot]

google-cloud-secure_source_manager-v1/lib/google/cloud/secure_source_manager/v1/secure_source_manager/paths.rb

@@ -106,6 +106,25 @@ def hook_path project:, location:, repository:, hook:
               "projects/#{project}/locations/#{location}/repositories/#{repository}/hooks/#{hook}"
             end
 
+            ##
+            # Create a fully-qualified InspectTemplate resource string.
+            #
+            # The resource will be in the following format:
+            #
+            # `projects/{project}/locations/{location}/inspectTemplates/{inspect_template}`
+            #
+            # @param project [String]
+            # @param location [String]
+            # @param inspect_template [String]
+            #
+            # @return [::String]
+            def inspect_template_path project:, location:, inspect_template:
+              raise ::ArgumentError, "project cannot contain /" if project.to_s.include? "/"
+              raise ::ArgumentError, "location cannot contain /" if location.to_s.include? "/"
+
+              "projects/#{project}/locations/#{location}/inspectTemplates/#{inspect_template}"
+            end
+
             ##
             # Create a fully-qualified Instance resource string.
             #
@@ -249,6 +268,23 @@ def repository_path project:, location:, repository:
               "projects/#{project}/locations/#{location}/repositories/#{repository}"
             end
 
+            ##
+            # Create a fully-qualified ServiceAccount resource string.
+            #
+            # The resource will be in the following format:
+            #
+            # `projects/{project}/serviceAccounts/{service_account}`
+            #
+            # @param project [String]
+            # @param service_account [String]
+            #
+            # @return [::String]
+            def service_account_path project:, service_account:
+              raise ::ArgumentError, "project cannot contain /" if project.to_s.include? "/"
+
+              "projects/#{project}/serviceAccounts/#{service_account}"
+            end
+
             ##
             # Create a fully-qualified ServiceAttachment resource string.
             #

google-cloud-secure_source_manager-v1/lib/google/cloud/securesourcemanager/v1/secure_source_manager_pb.rb

@@ -235,6 +235,12 @@ module StateNote
         # @!attribute [rw] initial_config
         #   @return [::Google::Cloud::SecureSourceManager::V1::Repository::InitialConfig]
         #     Input only. Initial configurations for the repository.
+        # @!attribute [rw] service_account
+        #   @return [::String]
+        #     Optional. Repository level service account (BYOSA).
+        # @!attribute [rw] scan_config
+        #   @return [::Google::Cloud::SecureSourceManager::V1::Repository::ScanConfig]
+        #     Optional. Provides configuration for scanning.
         class Repository
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -396,6 +402,27 @@ class InitialConfig
             include ::Google::Protobuf::MessageExts
             extend ::Google::Protobuf::MessageExts::ClassMethods
           end
+
+          # Configuration for scanning.
+          # @!attribute [rw] secret_scan_config
+          #   @return [::Google::Cloud::SecureSourceManager::V1::Repository::ScanConfig::SecretScanConfig]
+          #     Optional. Configuration for secret scanning.
+          class ScanConfig
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # Configuration for secret scanning.
+            # @!attribute [rw] enabled
+            #   @return [::Boolean]
+            #     Optional. Enables secret scanning for the repository.
+            # @!attribute [rw] inspect_template
+            #   @return [::String]
+            #     Optional. The DLP inspect template to use for secret scanning.
+            class SecretScanConfig
+              include ::Google::Protobuf::MessageExts
+              extend ::Google::Protobuf::MessageExts::ClassMethods
+            end
+          end
         end
 
         # Metadata of a Secure Source Manager Hook.

google-cloud-secure_source_manager-v1/proto_docs/google/cloud/securesourcemanager/v1/secure_source_manager.rb

@@ -89,6 +89,18 @@ def test_hook_path
     end
   end
 
+  def test_inspect_template_path
+    grpc_channel = ::GRPC::Core::Channel.new "localhost:8888", nil, :this_channel_is_insecure
+    ::Gapic::ServiceStub.stub :new, DummyStub.new do
+      client = ::Google::Cloud::SecureSourceManager::V1::SecureSourceManager::Client.new do |config|
+        config.credentials = grpc_channel
+      end
+
+      path = client.inspect_template_path project: "value0", location: "value1", inspect_template: "value2"
+      assert_equal "projects/value0/locations/value1/inspectTemplates/value2", path
+    end
+  end
+
   def test_instance_path
     grpc_channel = ::GRPC::Core::Channel.new "localhost:8888", nil, :this_channel_is_insecure
     ::Gapic::ServiceStub.stub :new, DummyStub.new do
@@ -173,6 +185,18 @@ def test_repository_path
     end
   end
 
+  def test_service_account_path
+    grpc_channel = ::GRPC::Core::Channel.new "localhost:8888", nil, :this_channel_is_insecure
+    ::Gapic::ServiceStub.stub :new, DummyStub.new do
+      client = ::Google::Cloud::SecureSourceManager::V1::SecureSourceManager::Client.new do |config|
+        config.credentials = grpc_channel
+      end
+
+      path = client.service_account_path project: "value0", service_account: "value1"
+      assert_equal "projects/value0/serviceAccounts/value1", path
+    end
+  end
+
   def test_service_attachment_path
     grpc_channel = ::GRPC::Core::Channel.new "localhost:8888", nil, :this_channel_is_insecure
     ::Gapic::ServiceStub.stub :new, DummyStub.new do