Support policy checks

buf/registry/module/v1beta1/label.proto

@@ -61,6 +61,7 @@ message Label {
   ];
   // The id of the Commit currently associated with the Label.
   //
+  // If policy checks are enabled, this will point to the most recent Commit that passed or was approved.
   // To get the history of the Commits that have been associated with a Label, use ListLabelHistory.
   string commit_id = 8 [
     (buf.validate.field).required = true,
@@ -71,6 +72,55 @@ message Label {
     (buf.validate.field).required = true,
     (buf.validate.field).string.uuid = true
   ];
+  // Whether or not policy checks are enabled for this Label.
+  //
+  // Policy checks are an enterprise-only feature - contact us to learn more!
+  bool policy_checks_enabled = 10;
+  // The PolicyChecksState for the Commit the Label points to.
+  //
+  // This field will be set if either:
+  //   - Policy checks were enabled on this Label when this Commit was pushed.
+  //   - This Commit transitively depends on a Commit that has a PolicyChecksState.
+  PolicyChecksState policy_checks_state = 11;
+}
+
+// The state of a Commit's policy checks for a particular Label.
+//
+// Policy checks are an enterprise-only feature - contact us to learn more!
+message PolicyChecksState {
+  // The status of the policy checks.
+  PolicyChecksStatus status = 1 [(buf.validate.field).enum.defined_only = true];
+
+  // The time the status was last updated.
+  google.protobuf.Timestamp status_updated_at = 3 [(buf.validate.field).required = true];
+
+  // The ids of Commits that have policy checks blocking these policy checks.
+  //
+  // This field will only be set if the status is blocked.
+  repeated string blocked_on_commit_ids = 2 [(buf.validate.field).string.uuid = true];
+}
+
+// The status of a PolicyChecksState.
+//
+// Policy checks are an enterprise-only feature - contact us to learn more!
+enum PolicyChecksStatus {
+  POLICY_CHECKS_STATUS_UNSPECIFIED = 0;
+  // The Commit did not fail any policy checks and therefore did not need review.
+  POLICY_CHECKS_STATUS_PASSED = 1;
+  // The Commit was reviewed after failing policy checks and was approved.
+  POLICY_CHECKS_STATUS_APPROVED = 2;
+  // The Commit was reviewed after failing policy checks and was rejected.
+  POLICY_CHECKS_STATUS_REJECTED = 3;
+  // The Commit has not yet been reviewed after failing policy checks and is pending.
+  POLICY_CHECKS_STATUS_PENDING = 4;
+  // The policy checks for this Commit are blocked on pending policy checks for at least one other Commit.
+  //
+  // If at least one dependent Commit is rejected, this Commit will inherit the rejected status.
+  // If all dependent Commits are passed or approved, then the status for this Commit will transition to:
+  //   - Passed if policy checks are not enabled for this Label.
+  //   - Passed if policy checks are enabled for this Label and all checks passed.
+  //   - Pending if policy checks are enabled for this Label and some checks failed.
+  POLICY_CHECKS_STATUS_BLOCKED = 5;
 }
 
 // LabelRef is a reference to a Label, either an id or a fully-qualified name.

buf/registry/module/v1beta1/label_service.proto

@@ -96,7 +96,8 @@ message ListLabelsRequest {
   // Once the resource is resolved, the following Labels are listed:
   //   - If a Module is referenced, all Labels for the Module are returned.
   //   - If a Label is referenced, this Label is returned.
-  //   - If a Commit is referenced, all Labels for the Commit are returned.
+  //   - If a Commit is referenced, all Labels that currently point to the Commit are returned.
+  //     Labels where this Commit has a PolicyChecksStatus that is neither approved nor passed will not be returned.
   ResourceRef resource_ref = 3 [(buf.validate.field).required = true];
   // The order to return the Labels.
   //
@@ -106,6 +107,10 @@ message ListLabelsRequest {
   // TODO: We are purposefully not making the default the zero enum value, however
   // we may want to consider this.
   Order order = 4 [(buf.validate.field).enum.defined_only = true];
+  // Only return Labels that point to a Commit with one of these PolicyChecksStatus values.
+  //
+  // If not set, Labels that point to a Commit with any PolicyChecksStatus value are returned.
+  repeated PolicyChecksStatus policy_checks_statuses = 5 [(buf.validate.field).repeated.items.enum.defined_only = true];
 }
 
 message ListLabelsResponse {
@@ -157,12 +162,24 @@ message ListLabelHistoryRequest {
 }
 
 message ListLabelHistoryResponse {
+  message Value {
+    // The Commit.
+    Commit commit = 1 [(buf.validate.field).required = true];
+
+    // The PolicyChecksState for this Commit on this Label.
+    //
+    // This field will be set if either:
+    //   - Policy checks were enabled on this Label when this Commit was pushed.
+    //   - This Commit transitively depends on a Commit that has a PolicyChecksState.
+    PolicyChecksState policy_checks_state = 2;
+  }
+
   // The next page token.
   //
   /// If empty, there are no more pages.
   string next_page_token = 1 [(buf.validate.field).string.max_len = 4096];
-  // The listed Commits that represent the history of the Label.
-  repeated Commit commits = 2;
+  // The ordered history of the Label.
+  repeated Value values = 2;
 }
 
 message CreateOrUpdateLabelsRequest {