Support policy checks

buf/registry/module/v1beta1/label.proto

@@ -59,8 +59,9 @@ message Label {
     (buf.validate.field).required = true,
     (buf.validate.field).string.uuid = true
   ];
-  // The id of the Commit currently associated with the Label.
+  // The id of the currently passed or accepted Commit currently associated with the Label.
   //
+  // Labels will only point to passed or accepted commits, and never point to rejected or pending Commits.
   // To get the history of the Commits that have been associated with a Label, use ListLabelHistory.
   string commit_id = 8 [
     (buf.validate.field).required = true,
@@ -71,6 +72,30 @@ message Label {
     (buf.validate.field).required = true,
     (buf.validate.field).string.uuid = true
   ];
+
+  // Whether or not governance review is enabled for this Label.
+  //
+  // Governance is an enterprise-only feature - contact us to learn more!
+  bool review_enabled = 10;
+  // The current review state of the Label.
+  //
+  // This field will only be set if governance is enabled.
+  LabelReviewState review_state = 11 [(buf.validate.field).enum.defined_only = true];
+}
+
+// The label state in the governance review flow.
+//
+// Governance is an enterprise-only feature - contact us to learn more!
+enum LabelReviewState {
+  LABEL_REVIEW_STATE_UNSPECIFIED = 0;
+  // The last Commit pushed to the Label did not fail any governance checks and therefore did not need review.
+  LABEL_REVIEW_STATE_PASSED = 1;
+  // The last Commit pushed to the Label was reviewed after failing governance checks and was accepted.
+  LABEL_REVIEW_STATE_ACCEPTED = 2;
+  // The last Commit pushed to the Label was reviewed after failing governance checks and was rejected.
+  LABEL_REVIEW_STATE_REJECTED = 3;
+  // The last Commit pushed to the Label has not yet been reviewed after failing governance checks and is pending.
+  LABEL_REVIEW_STATE_PENDING = 4;
 }
 
 // LabelRef is a reference to a Label, either an id or a fully-qualified name.

buf/registry/module/v1beta1/label_service.proto

@@ -21,6 +21,7 @@ import "buf/registry/module/v1beta1/digest.proto";
 import "buf/registry/module/v1beta1/label.proto";
 import "buf/registry/module/v1beta1/resource.proto";
 import "buf/validate/validate.proto";
+import "google/protobuf/timestamp.proto";
 
 option go_package = "buf.build/gen/go/bufbuild/registry/protocolbuffers/go/buf/registry/module/v1beta1";
 
@@ -96,7 +97,9 @@ message ListLabelsRequest {
   // Once the resource is resolved, the following Labels are listed:
   //   - If a Module is referenced, all Labels for the Module are returned.
   //   - If a Label is referenced, this Label is returned.
-  //   - If a Commit is referenced, all Labels for the Commit are returned.
+  //   - If a Commit is referenced, all Labels for the Commit are returned. Note that this will
+  //     not return any Labels where the Commit is currently rejected or pending, it will only
+  //     return Labels for Commits that are passed or accepted.
   ResourceRef resource_ref = 3 [(buf.validate.field).required = true];
   // The order to return the Labels.
   //
@@ -106,6 +109,10 @@ message ListLabelsRequest {
   // TODO: We are purposefully not making the default the zero enum value, however
   // we may want to consider this.
   Order order = 4 [(buf.validate.field).enum.defined_only = true];
+  // Only return Labels that have these governance review states.
+  //
+  // By default, Labels with any governance review state are returned.
+  repeated LabelReviewState review_states = 5;
 }
 
 message ListLabelsResponse {
@@ -157,12 +164,26 @@ message ListLabelHistoryRequest {
 }
 
 message ListLabelHistoryResponse {
+  message Value {
+    // The Commit.
+    Commit commit = 1 [(buf.validate.field).required = true];
+
+    // The Label's review state.
+    //
+    // This field will only be set if governance is enabled for the Label.
+    LabelReviewState review_state = 2 [(buf.validate.field).enum.defined_only = true];
+    // When the review state was last updated.
+    //
+    // This field will only be set if governance is enabled for the Label.
+    google.protobuf.Timestamp review_state_updated_at = 3;
+  }
+
   // The next page token.
   //
   /// If empty, there are no more pages.
   string next_page_token = 1 [(buf.validate.field).string.max_len = 4096];
-  // The listed Commits that represent the history of the Label.
-  repeated Commit commits = 2;
+  // The ordered history of the Label.
+  repeated Value values = 2;
 }
 
 message CreateOrUpdateLabelsRequest {

buf/registry/module/v1beta1/upload_service.proto

@@ -42,6 +42,8 @@ message UploadRequest {
     //
     // If the ModuleRef refers to a Module that has associated Content, this field should *not*
     // be set, and setting it is an error.
+    //
+    // The commit_id must point to a passed or accepted Commit.
     string commit_id = 2 [(buf.validate.field).string.uuid = true];
   }
   // Content to upload for a given reference.