Help us shape the future of Go! Take the 2026 Go Developer Survey

capabilities

package
v0.1.310 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 1, 2026 License: Apache-2.0 Imports: 21 Imported by: 0

Documentation

Overview

Package capabilities contains the proto enum with our IAM capabilities.

Index

Examples

Constants

This section is empty.

Variables

View Source 
var (
	Capability_name = map[int32]string{}/* 230 elements not displayed */

	Capability_value = map[string]int32{}/* 230 elements not displayed */

)

Enum value maps for Capability.

View Source 
var (
	// This decorates our capability enumeration values with
	// the friendly name to show to humans.
	//
	// optional string name = 189350643;
	E_Name = &file_capabilities_proto_extTypes[0]
	// This decorates our capability enumeration values with
	// a bit index enabling compacted encodings.
	//
	// optional uint32 bit = 20221109;
	E_Bit = &file_capabilities_proto_extTypes[1]
	// This decorates our capability enumeration values with a marker denoting the
	// capability as internal only: it can never be granted by a role available to
	// customer organisations. Roles which contain internal only capabilities must
	// have `CAP_INTERNAL` set. Role creation/updating will fail if this is
	// violated.
	//
	// optional bool internal_only = 189350644;
	E_InternalOnly = &file_capabilities_proto_extTypes[2]
)

Extension fields to descriptorpb.EnumValueOptions.

View Source 
var (
	// ConsoleViewerCaps are read-only API capabilities that do not affect state,
	// and cannot pull artifacts from registries.
	ConsoleViewerCaps = SortCaps([]Capability{
		Capability_CAP_EVENTS_SUBSCRIPTION_LIST,

		Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_LIST,
		Capability_CAP_IAM_GROUP_INVITES_LIST,
		Capability_CAP_IAM_GROUPS_LIST,
		Capability_CAP_IAM_ROLE_BINDINGS_LIST,
		Capability_CAP_IAM_ROLES_LIST,
		Capability_CAP_IAM_IDENTITY_LIST,
		Capability_CAP_IAM_IDENTITY_PROVIDERS_LIST,

		Capability_CAP_REPO_LIST,
		Capability_CAP_MANIFEST_LIST,
		Capability_CAP_REFERRERS_LIST,
		Capability_CAP_TAG_LIST,
		Capability_CAP_MANIFEST_METADATA_LIST,
		Capability_CAP_APK_LIST,

		Capability_CAP_TENANT_RECORD_SIGNATURES_LIST,
		Capability_CAP_TENANT_SBOMS_LIST,
		Capability_CAP_TENANT_VULN_REPORTS_LIST,

		Capability_CAP_VERSION_LIST,

		Capability_CAP_VULN_REPORT_LIST,

		Capability_CAP_BUILD_REPORT_LIST,

		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_ARTIFACTS_LIST,
		Capability_CAP_LIBRARIES_CACHE_LIST,

		Capability_CAP_LIBRARIES_REQUEST_GROUPS_LIST,

		Capability_CAP_SKILLS_ENTITLEMENTS_LIST,
		Capability_CAP_SKILLS_LIST,

		Capability_CAP_REGISTRY_ENTITLEMENTS_LIST,
		Capability_CAP_REGISTRY_DEPLOYMENTS_LIST,

		Capability_CAP_REGISTRY_SETTINGS_LIST,

		Capability_CAP_REGISTRY_OVERLAYS_LIST,

		Capability_CAP_POLICIES_POLICY_LIST,
		Capability_CAP_POLICIES_BINDING_LIST,
		Capability_CAP_POLICIES_DECISION_LIST,
		Capability_CAP_POLICIES_OVERRIDE_LIST,

		Capability_CAP_LIBRARIES_POLICY_LIST,
		Capability_CAP_LIBRARIES_POLICY_BINDING_LIST,
		Capability_CAP_LIBRARIES_POLICY_BLOCK_EVENT_LIST,

		Capability_CAP_LIBRARIES_REMOTE_REGISTRIES_LIST,

		Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_LIST,

		Capability_CAP_PACKAGES_ENTITLEMENTS_LIST,
		Capability_CAP_ADVISORIES_LIST,

		Capability_CAP_ACTIONS_LIST,

		Capability_CAP_GUARDENER_ENTITLEMENT_LIST,
		Capability_CAP_GUARDENER_SCAN_LIST,
		Capability_CAP_GUARDENER_SCAN_GET,
	})

	// ViewerCaps are read-only capabilities that do not affect state,
	// but are allowed to pull from container and apk registries.
	ViewerCaps = SortCaps(ConsoleViewerCaps,

		RegistryPullCaps, APKPullCaps,

		GuardenerUserCaps)

	// EditorCaps can modify state, but not grant roles/permissions.
	EditorCaps = SortCaps([]Capability{
		Capability_CAP_EVENTS_SUBSCRIPTION_CREATE,
		Capability_CAP_EVENTS_SUBSCRIPTION_DELETE,
		Capability_CAP_EVENTS_SUBSCRIPTION_UPDATE,

		Capability_CAP_LIBRARIES_REQUEST_GROUPS_CREATE,
		Capability_CAP_LIBRARIES_REQUEST_GROUPS_UPDATE,
		Capability_CAP_LIBRARIES_REQUEST_GROUPS_DELETE,
		Capability_CAP_LIBRARIES_REQUEST_GROUPS_ITEMS_UPDATE,
	}, RegistryEditorCaps, ViewerCaps)

	// SkillsPublishCaps is the capability set required to publish skill artifacts
	// to skills.cgr.dev. Included in OwnerCaps so org owners can push after
	// provisioning a skills entitlement. Can also be granted explicitly to a
	// service principal or non-owner member via chainctl iam role-bindings create.
	//
	// CAP_TERMS_LIST lets chainctl's pre-flight read the org's accepted-docs
	// list so it knows whether to prompt with the TUI before remote.Write.
	//
	// The skills.{write,delete} catalog-write caps are internal_only and
	// deliberately NOT here: this bundle is customer-grantable, and the catalog
	// is written by the Chainguard publish pipeline via a CAP_INTERNAL role, not
	// by customer skills publishers.
	//
	// The skills.harden.{read,write,cancel} caps are customer-facing: they let a
	// skills-entitled publisher submit, track, and cancel harden jobs. They do
	// NOT write the hardened output — publishing the hardened artifact and
	// recording the job result is done by internal identities (skills.write is
	// internal_only; the record-result RPC is gated on CAP_INTERNAL), so this
	// bundle stays customer-safe.
	SkillsPublishCaps = SortCaps([]Capability{
		Capability_CAP_SKILLS_PUBLISH,
		Capability_CAP_SKILLS_ENTITLEMENTS_LIST,
		Capability_CAP_SKILLS_HARDEN_READ,
		Capability_CAP_SKILLS_HARDEN_WRITE,
		Capability_CAP_SKILLS_HARDEN_CANCEL,
		Capability_CAP_TERMS_LIST,
	})

	// OwnerCaps includes all capabilities possible by a user.
	OwnerCaps = SortCaps([]Capability{
		Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_CREATE,
		Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_DELETE,
		Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_UPDATE,

		Capability_CAP_IAM_GROUP_INVITES_CREATE,
		Capability_CAP_IAM_GROUP_INVITES_DELETE,

		Capability_CAP_IAM_GROUPS_CREATE,
		Capability_CAP_IAM_GROUPS_DELETE,
		Capability_CAP_IAM_GROUPS_UPDATE,

		Capability_CAP_IAM_IDENTITY_CREATE,
		Capability_CAP_IAM_IDENTITY_DELETE,
		Capability_CAP_IAM_IDENTITY_UPDATE,

		Capability_CAP_IAM_IDENTITY_PROVIDERS_CREATE,
		Capability_CAP_IAM_IDENTITY_PROVIDERS_DELETE,
		Capability_CAP_IAM_IDENTITY_PROVIDERS_UPDATE,
		Capability_CAP_IAM_SCIM_MANAGE,

		Capability_CAP_IAM_SCIM_USERS_LIST,

		Capability_CAP_IAM_ROLE_BINDINGS_CREATE,
		Capability_CAP_IAM_ROLE_BINDINGS_DELETE,
		Capability_CAP_IAM_ROLE_BINDINGS_UPDATE,

		Capability_CAP_IAM_ROLES_CREATE,
		Capability_CAP_IAM_ROLES_DELETE,
		Capability_CAP_IAM_ROLES_UPDATE,

		Capability_CAP_VULN_CREATE,
		Capability_CAP_VULN_REPORT_CREATE,

		Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_ADD,
		Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_REMOVE,
		Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_SWAP,

		Capability_CAP_LIBRARIES_ENTITLEMENTS_CREATE,
		Capability_CAP_LIBRARIES_ENTITLEMENTS_DELETE,

		Capability_CAP_SKILLS_ENTITLEMENTS_CREATE,
		Capability_CAP_SKILLS_ENTITLEMENTS_DELETE,

		Capability_CAP_LIBRARIES_CACHE_INVALIDATE,
		Capability_CAP_REPO_CHECK_POLICIES,

		Capability_CAP_POLICIES_POLICY_CREATE,
		Capability_CAP_POLICIES_POLICY_UPDATE,
		Capability_CAP_POLICIES_POLICY_DELETE,
		Capability_CAP_POLICIES_BINDING_CREATE,
		Capability_CAP_POLICIES_BINDING_UPDATE,
		Capability_CAP_POLICIES_BINDING_DELETE,
		Capability_CAP_POLICIES_OVERRIDE_CREATE,
		Capability_CAP_POLICIES_OVERRIDE_DELETE,

		Capability_CAP_LIBRARIES_POLICY_CREATE,
		Capability_CAP_LIBRARIES_POLICY_UPDATE,
		Capability_CAP_LIBRARIES_POLICY_DELETE,
		Capability_CAP_LIBRARIES_POLICY_BINDING_CREATE,
		Capability_CAP_LIBRARIES_POLICY_BINDING_UPDATE,
		Capability_CAP_LIBRARIES_POLICY_BINDING_DELETE,

		Capability_CAP_LIBRARIES_REMOTE_REGISTRIES_CREATE,
		Capability_CAP_LIBRARIES_REMOTE_REGISTRIES_DELETE,

		Capability_CAP_LIBRARIES_STORAGE_USAGE_GET,

		Capability_CAP_TERMS_ACCEPT,
		Capability_CAP_TERMS_LIST,

		Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE,
		Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_UPDATE,

		Capability_CAP_LIBRARIES_REQUEST_GROUPS_SUBMIT,

		Capability_CAP_MCP_TOOL_CALL,
	}, EditorCaps,

		RegistryPushCaps, APKPushCaps, LibrariesJavaPushCaps, LibrariesJavascriptPushCaps, LibrariesPythonPushCaps, LibrariesDotnetPushCaps, LibrariesGoPushCaps,

		LibrariesJavaPullCaps, LibrariesPythonPullCaps, LibrariesJavascriptPullCaps, LibrariesDotnetPullCaps, LibrariesGoPullCaps, LibrariesRubyPullCaps,

		SkillsPublishCaps,

		GuardenerAdminCaps,

		SandboxUserCaps,
	)

	RegistryRepoAdminCaps = SortCaps(RegistryEditorCaps)

	RegistryEditorCaps = SortCaps([]Capability{
		Capability_CAP_REPO_CREATE,
		Capability_CAP_REPO_UPDATE,
		Capability_CAP_REPO_DELETE,

		Capability_CAP_REGISTRY_OVERLAYS_LIST,
		Capability_CAP_REGISTRY_OVERLAYS_EDIT,
	}, RegistryPullCaps)

	RegistryPullCaps = SortCaps([]Capability{
		Capability_CAP_REPO_BLOBS_GET,

		Capability_CAP_IAM_GROUPS_LIST,

		Capability_CAP_REPO_LIST,
		Capability_CAP_MANIFEST_LIST,
		Capability_CAP_REFERRERS_LIST,
		Capability_CAP_TAG_LIST,
		Capability_CAP_MANIFEST_METADATA_LIST,

		Capability_CAP_TENANT_RECORD_SIGNATURES_LIST,
		Capability_CAP_TENANT_SBOMS_LIST,
		Capability_CAP_TENANT_VULN_REPORTS_LIST,
	})

	RegistryPushCaps = SortCaps([]Capability{
		Capability_CAP_REPO_CREATE,
		Capability_CAP_REPO_UPDATE,
		Capability_CAP_REPO_DELETE,

		Capability_CAP_MANIFEST_CREATE,
		Capability_CAP_MANIFEST_UPDATE,
		Capability_CAP_MANIFEST_DELETE,

		Capability_CAP_TAG_CREATE,
		Capability_CAP_TAG_UPDATE,
		Capability_CAP_TAG_DELETE,

		Capability_CAP_IAM_GROUPS_CREATE,
	}, RegistryPullCaps)

	// PullTokenCreatorCaps is the minimal set of capabilities to create a pull token.
	PullTokenCreatorCaps = SortCaps([]Capability{

		Capability_CAP_IAM_ROLE_BINDINGS_CREATE,
		Capability_CAP_IAM_IDENTITY_CREATE,

		Capability_CAP_IAM_ROLES_LIST,

		Capability_CAP_IAM_GROUPS_LIST,
	})

	RegistryPullTokenCreatorCaps = SortCaps(PullTokenCreatorCaps, RegistryPullCaps, APKPullCaps)

	APKPullCaps = SortCaps([]Capability{
		Capability_CAP_APK_BLOBS_GET,
		Capability_CAP_IAM_GROUPS_LIST,
		Capability_CAP_APK_LIST,
	})

	APKPushCaps = SortCaps([]Capability{
		Capability_CAP_IAM_GROUPS_LIST,
		Capability_CAP_APK_CREATE,
		Capability_CAP_APK_DELETE,
	}, APKPullCaps)

	AdvisoriesViewerCaps = SortCaps([]Capability{
		Capability_CAP_ADVISORIES_LIST,
	})

	// ActionsViewerCaps is the minimal capability set for reading the
	// Chainguard Actions catalog. It backs the actions.viewer role, granted to
	// the public-puller identity so the catalog is readable without org
	// membership.
	ActionsViewerCaps = SortCaps([]Capability{
		Capability_CAP_ACTIONS_LIST,
	})

	// ActionsDependencyWriterCaps is the capability set for the hardening pipeline,
	// the entire audience for the dependency graph. Both caps are internal only,
	// since reads are fenced to the caller's own groups. CAP_INTERNAL is required.
	ActionsDependencyWriterCaps = SortCaps([]Capability{
		Capability_CAP_INTERNAL,
		Capability_CAP_ACTIONS_DEPENDENCIES_LIST,
		Capability_CAP_ACTIONS_DEPENDENCIES_UPDATE,
	})

	AdvisoriesCreatorCaps = SortCaps([]Capability{
		Capability_CAP_ADVISORIES_CREATE,
		Capability_CAP_ADVISORIES_UPDATE,
	}, AdvisoriesViewerCaps)

	AdvisoriesApproverCaps = SortCaps([]Capability{
		Capability_CAP_ADVISORIES_APPROVE,
	}, AdvisoriesCreatorCaps)

	AdvisoriesAdminCaps = SortCaps([]Capability{
		Capability_CAP_ADVISORIES_DELETE,
	}, AdvisoriesApproverCaps)

	LibrariesJavaPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_JAVA_LIST,
	})

	LibrariesJavaPushCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_JAVA_CREATE,
	}, LibrariesJavaPullCaps)

	LibrariesPythonPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_PYTHON_LIST,
	})

	LibrariesPythonPushCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_PYTHON_CREATE,
	}, LibrariesPythonPullCaps)

	LibrariesJavascriptPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_JAVASCRIPT_LIST,
	})

	LibrariesJavascriptPushCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_JAVASCRIPT_CREATE,
	}, LibrariesJavascriptPullCaps)

	LibrariesDotnetPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_DOTNET_LIST,
	})

	LibrariesDotnetPushCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_DOTNET_CREATE,
	}, LibrariesDotnetPullCaps)

	LibrariesGoPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_GO_LIST,
	})

	LibrariesGoPushCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_GO_CREATE,
	}, LibrariesGoPullCaps)

	LibrariesRubyPullCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST,
		Capability_CAP_LIBRARIES_RUBY_LIST,
	})

	// The rebuilder capabilities are all (internal_only), so every rebuilder
	// bundle must also grant CAP_INTERNAL — the internal-only validation enforces
	// that pairing, which keeps these capabilities off customer-grantable roles.
	LibrariesRebuilderRequestsCreateCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_LIST,
		Capability_CAP_INTERNAL,
	})

	LibrariesRebuilderViewerCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_REMEDIATED_ARTIFACTS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_LIST,
		Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_READ,
		Capability_CAP_INTERNAL,
	})

	// LibrariesRebuilderTrustedCaps is for the trusted SA (e.g. prepare phase) that
	// can fetch build-scoped JWT tokens.
	LibrariesRebuilderTrustedCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_TOKENS_FETCH,
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ,
		Capability_CAP_INTERNAL,
	})

	// LibrariesRebuilderUntrustedCaps is for untrusted build/test pods. They combine
	// this Chainguard identity check with a per-build JWT token for defence in depth.
	// The read-only malware-status capability lets the build pipeline (e.g. the
	// prepare phase) gate which package versions enter the build matrix; it is
	// read-only and low-risk, so it lives on the untrusted role rather than
	// requiring a separate trusted service account.
	LibrariesRebuilderUntrustedCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_UNTRUSTED,
		Capability_CAP_LIBRARIES_REBUILDER_MALWARE_STATUS_READ,
		Capability_CAP_INTERNAL,
	})

	LibrariesRebuilderAdminCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_LIST,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CANCEL,
		Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_GROUP_UPDATE,
		Capability_CAP_LIBRARIES_REBUILDER_ARTIFACTS_INVALIDATE,
		Capability_CAP_LIBRARIES_REBUILDER_EXCLUSIONS_MANAGE,
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_TOKENS_FETCH,
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_UNTRUSTED,
		Capability_CAP_LIBRARIES_REBUILDER_REMEDIATED_ARTIFACTS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_REFRESH,
		Capability_CAP_LIBRARIES_REBUILDER_MALWARE_STATUS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_CVE_REMEDIATIONS_LIST,
		Capability_CAP_LIBRARIES_REBUILDER_CVE_REMEDIATIONS_UPDATE,

		Capability_CAP_LIBRARIES_REQUEST_GROUPS_REFRESH_COVERAGE,
		Capability_CAP_LIBRARIES_REQUEST_GROUPS_DELETE_SUBMITTED,

		Capability_CAP_LIBRARIES_REBUILDER_SOURCE_COORDINATES_RESOLVE,

		Capability_CAP_INTERNAL,
	})

	// LibrariesRebuilderSourceResolverCaps is for the source-coordinate reconciler's
	// identity (the source-resolver-reconciler service): it reads build and source data
	// (builds.read) and writes resolved source coordinates back
	// (source_coordinates.write). Least-privilege: only those two, plus CAP_INTERNAL for
	// the internal-only pairing.
	LibrariesRebuilderSourceResolverCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ,
		Capability_CAP_LIBRARIES_REBUILDER_SOURCE_COORDINATES_WRITE,
		Capability_CAP_INTERNAL,
	})

	// LibrariesRebuilderResolveCaps is the enqueue-only counterpart to the
	// reconciler's write bundle above: it lets a caller request on-demand source
	// resolution via rebuilder-api's :resolve endpoint (source_coordinates.resolve),
	// and nothing more. It deliberately excludes source_coordinates.write —
	// enqueueing a resolve must not confer the ability to write canonical
	// coordinates (that stays reconciler-only, LibrariesRebuilderSourceResolverCaps).
	// Granting this rather than the broad admin bundle (which also carries resolve)
	// gives staff / libraries engineers a least-privilege way to drive resolution.
	// CAP_INTERNAL is required because source_coordinates.resolve is (internal_only).
	LibrariesRebuilderResolveCaps = SortCaps([]Capability{
		Capability_CAP_LIBRARIES_REBUILDER_SOURCE_COORDINATES_RESOLVE,
		Capability_CAP_INTERNAL,
	})

	// GuardenerUserCaps is the minimum capability set required to run
	// guardener (DFC) sessions against a group. terms.list is required
	// because the DFC server checks the group's terms-of-service
	// acceptance with the caller's credentials before starting a session.
	// Registry pull caps are included so users can fetch the base images
	// the DFC session converts to. association.list is the read-only
	// counterpart to association.manage, so users can see which GitHub orgs
	// are linked to the group without being able to link or unlink them.
	// actions.migrate lets users enqueue an on-demand GitHub Actions
	// migration for a repository in the group. scan.list/scan.get let
	// users read the dependency scans guardener builds for the group's
	// repositories.
	GuardenerUserCaps = SortCaps([]Capability{
		Capability_CAP_GUARDENER_DFC_CONVERT,
		Capability_CAP_GUARDENER_ASSOCIATION_LIST,
		Capability_CAP_GUARDENER_ACTIONS_MIGRATE,
		Capability_CAP_GUARDENER_SCAN_LIST,
		Capability_CAP_GUARDENER_SCAN_GET,
		Capability_CAP_TERMS_LIST,
	}, RegistryPullCaps)

	// GuardenerAdminCaps extends GuardenerUserCaps with terms.accept so
	// admins can record acceptance of the legal documents that the DFC
	// server requires before sessions can start, and association.manage so
	// admins can self-service link/unlink a GitHub org to the group.
	GuardenerAdminCaps = SortCaps([]Capability{
		Capability_CAP_TERMS_ACCEPT,
		Capability_CAP_GUARDENER_ASSOCIATION_MANAGE,
	}, GuardenerUserCaps)

	MCPToolUserCaps = SortCaps([]Capability{
		Capability_CAP_MCP_TOOL_CALL,
	})

	// SandboxUserCaps is the capability set for using the ACID sandbox Runs
	// control plane (the WorkflowRuns API): submitting workflow runs, reading
	// them and their operations, and cancelling them, all scoped to the
	// caller's own instance (group). It backs the sandbox.user role and is
	// included in OwnerCaps.
	SandboxUserCaps = SortCaps([]Capability{
		Capability_CAP_SANDBOX_RUN_CREATE,
		Capability_CAP_SANDBOX_RUN_LIST,
		Capability_CAP_SANDBOX_RUN_CANCEL,
	})

	// ArgosOperatorCaps is the capability set for managing argos
	// (client-side-encrypted document) records.
	ArgosOperatorCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_DOCUMENTS_CREATE,
		Capability_CAP_ARGOS_DOCUMENTS_DELETE,
		Capability_CAP_ARGOS_DOCUMENTS_LIST,
		Capability_CAP_ARGOS_DOCUMENTATION_READ,
	})

	// ArgosDocumentationReaderCaps is the capability set for reading Argos API
	// documentation. Granted to orgs or identities that need documentation
	// access without full operator privileges.
	ArgosDocumentationReaderCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_DOCUMENTATION_READ,
	})

	// ArgosOSVReaderCaps is the capability set for reading the shared,
	// customer-blind Private OSV corpus. It is kept separate from
	// ArgosOperatorCaps (document management) and is granted to participating
	// orgs via the dedicated argos.osv.reader role, never to staff or org
	// owners by default.
	ArgosOSVReaderCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_OSV_READ,
	})

	// ArgosOSVDumperCaps is the capability set for bulk-exporting the shared
	// Private OSV corpus via the Dump RPC. The Dump RPC requires
	// CAP_ARGOS_OSV_DUMP.
	ArgosOSVDumperCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_OSV_DUMP,
	})

	// ArgosCoalitionMemberCaps marks an identity as an Athena coalition member.
	ArgosCoalitionMemberCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_COALITION_MEMBER,
	})

	// ArgosMitigationPartnerCaps marks an identity as a mitigation partner,
	// whose CGP visibility is limited to its approved capabilities.
	ArgosMitigationPartnerCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_MITIGATION_PARTNER,
	})

	// ArgosMitigationPartnerCapabilityRequesterCaps lets a mitigation partner
	// submit its capabilities and interests for approval.
	ArgosMitigationPartnerCapabilityRequesterCaps = SortCaps([]Capability{
		Capability_CAP_ARGOS_PARTNER_CAPABILITY_REQUEST,
	})
)
View Source 
var File_capabilities_proto protoreflect.FileDescriptor

Functions

func Bitify 

func Bitify(capability Capability) (uint32, error)

func Deprecated added in v0.1.21 

func Deprecated(capability Capability) bool

func InternalOnly added in v0.1.56 

func InternalOnly(capability Capability) bool

InternalOnly reports whether the capability is annotated as internal-only via the (internal_only) proto option. Capabilities that return true must never be granted by a role available to customer organisations.

func Names 

func Names() []string

Names returns a slice of all capabilities Stringify'd, sans UNKNOWN.

Example

ExampleNames demonstrates listing all known capability names. 

package main

import (
	"fmt"

	"chainguard.dev/sdk/proto/capabilities"
)

func main() {
	names := capabilities.Names()
	fmt.Println(len(names) > 0)
}

Output:
true

func Stringify 

func Stringify(capability Capability) (string, error)

func StringifyAll 

func StringifyAll(caps []Capability) ([]string, error)

StringifyAll is StringifyAllContext with context.Background(). Prefer StringifyAllContext where a context is available so the skip warning carries request logging metadata; some callers (package-variable initialization, descriptor walks) have none.

func StringifyAllContext added in v0.1.147 

func StringifyAllContext(ctx context.Context, caps []Capability) ([]string, error)

StringifyAllContext converts capabilities to their string names. A value with no descriptor is not in this binary's enum: either deleted from the proto (a stale value on a stored role, CUS-843) or added after this binary was built (deploy skew). Either way it grants nothing here, so it is skipped with a once-per-process warning rather than failing the whole list — otherwise a single stale capability on a stored role makes that role impossible to read or list, which takes down the Console IDP settings page. Other Stringify errors (a present enum value missing its options or name extension) indicate a proto authoring bug and are surfaced to the caller.

Types

type Capability 

type Capability int32

Capability is an enumeration of the Chainguard IAM capabilities. 

const (
	Capability_UNKNOWN                      Capability = 0
	Capability_CAP_INTERNAL                 Capability = 2
	Capability_CAP_IAM_GROUPS_CREATE        Capability = 101
	Capability_CAP_IAM_GROUPS_UPDATE        Capability = 102
	Capability_CAP_IAM_GROUPS_LIST          Capability = 103
	Capability_CAP_IAM_GROUPS_DELETE        Capability = 104
	Capability_CAP_IAM_GROUP_INVITES_CREATE Capability = 201
	Capability_CAP_IAM_GROUP_INVITES_LIST   Capability = 203
	Capability_CAP_IAM_GROUP_INVITES_DELETE Capability = 204
	Capability_CAP_IAM_ROLES_CREATE         Capability = 301
	Capability_CAP_IAM_ROLES_UPDATE         Capability = 302
	Capability_CAP_IAM_ROLES_LIST           Capability = 303
	Capability_CAP_IAM_ROLES_DELETE         Capability = 304
	Capability_CAP_IAM_ROLE_BINDINGS_CREATE Capability = 401
	Capability_CAP_IAM_ROLE_BINDINGS_UPDATE Capability = 402
	Capability_CAP_IAM_ROLE_BINDINGS_LIST   Capability = 403
	Capability_CAP_IAM_ROLE_BINDINGS_DELETE Capability = 404
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_CREATE Capability = 501
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_UPDATE Capability = 502
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_LIST Capability = 503
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_DELETE Capability = 504
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_CLUSTERS_DISCOVER Capability = 505
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_RECORDS_LIST Capability = 603
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_RECORD_CONTEXTS_LIST   Capability = 613
	Capability_CAP_TENANT_RECORD_SIGNATURES_LIST Capability = 623
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_RECORD_POLICY_RESULTS_LIST Capability = 633
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_RISKS_LIST Capability = 640
	Capability_CAP_TENANT_SBOMS_LIST Capability = 650
	// TODO(colin): deprecate this cap once the legacy endpoint is removed
	Capability_CAP_TENANT_VULN_REPORTS_LIST        Capability = 660
	Capability_CAP_TENANT_ATTESTATIONS_LIST        Capability = 670
	Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_CREATE Capability = 701
	Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_UPDATE Capability = 702
	Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_LIST   Capability = 703
	Capability_CAP_IAM_ACCOUNT_ASSOCIATIONS_DELETE Capability = 704
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_IAM_POLICY_CREATE Capability = 801
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_IAM_POLICY_UPDATE Capability = 802
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_IAM_POLICY_LIST Capability = 803
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_IAM_POLICY_DELETE   Capability = 804
	Capability_CAP_IAM_IDENTITY_CREATE Capability = 901
	Capability_CAP_IAM_IDENTITY_UPDATE Capability = 902
	Capability_CAP_IAM_IDENTITY_LIST   Capability = 903
	Capability_CAP_IAM_IDENTITY_DELETE Capability = 904
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_NODES_LIST Capability = 1003
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_NAMESPACES_LIST Capability = 1103
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_TENANT_WORKLOADS_LIST         Capability = 1203
	Capability_CAP_IAM_IDENTITY_PROVIDERS_CREATE Capability = 1301
	Capability_CAP_IAM_IDENTITY_PROVIDERS_UPDATE Capability = 1302
	Capability_CAP_IAM_IDENTITY_PROVIDERS_LIST   Capability = 1303
	Capability_CAP_IAM_IDENTITY_PROVIDERS_DELETE Capability = 1304
	Capability_CAP_IAM_SCIM_MANAGE               Capability = 1305
	Capability_CAP_IAM_SCIM_USERS_LIST           Capability = 1306
	Capability_CAP_EVENTS_SUBSCRIPTION_CREATE    Capability = 1501
	Capability_CAP_EVENTS_SUBSCRIPTION_UPDATE    Capability = 1502
	Capability_CAP_EVENTS_SUBSCRIPTION_LIST      Capability = 1503
	Capability_CAP_EVENTS_SUBSCRIPTION_DELETE    Capability = 1504
	// repo.blobs.get is a capability required to pull container images.
	// We explicitly define this to distinguish roles that allow browsing/viewing
	// metadata associated with images vs pulling the image itself.
	Capability_CAP_REPO_BLOBS_GET Capability = 1600
	// TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also
	// accept CAP_REPO_CREATE as a transitional grant for write access to
	// its REAPI cache surface. Once consumers have migrated to
	// CAP_CASSIE_CAS_WRITE, drop the dual-accept in cassie.
	Capability_CAP_REPO_CREATE Capability = 1603
	Capability_CAP_REPO_UPDATE Capability = 1604
	// TODO(laney): cassie's CAS/ActionCache/ByteStream handlers also
	// accept CAP_REPO_LIST as a transitional grant for read access to
	// its REAPI cache surface. Once consumers have migrated to
	// CAP_CASSIE_CAS_READ, drop the dual-accept in cassie.
	Capability_CAP_REPO_LIST              Capability = 1605
	Capability_CAP_REPO_DELETE            Capability = 1606
	Capability_CAP_MANIFEST_CREATE        Capability = 1607
	Capability_CAP_MANIFEST_UPDATE        Capability = 1608
	Capability_CAP_MANIFEST_LIST          Capability = 1609
	Capability_CAP_MANIFEST_DELETE        Capability = 1610
	Capability_CAP_TAG_CREATE             Capability = 1611
	Capability_CAP_TAG_UPDATE             Capability = 1612
	Capability_CAP_TAG_LIST               Capability = 1613
	Capability_CAP_TAG_DELETE             Capability = 1614
	Capability_CAP_MANIFEST_METADATA_LIST Capability = 1615
	Capability_CAP_REFERRERS_LIST         Capability = 1616
	// repo.internal.admin allows administering internal-only repository fields
	// (catalog tier, bundles, aliases, active tags, README, and sync settings)
	// that are otherwise read-only to customers.
	Capability_CAP_REPO_INTERNAL_ADMIN Capability = 1617
	// apk.blobs.get is a capability required to pull APKs.
	// We explicitly define this to distinguish roles that allow browsing/viewing
	// metadata associated with APKs vs pulling the APK itself.
	Capability_CAP_APK_BLOBS_GET      Capability = 1655
	Capability_CAP_APK_CREATE         Capability = 1650
	Capability_CAP_APK_UPDATE         Capability = 1651
	Capability_CAP_APK_LIST           Capability = 1652
	Capability_CAP_APK_DELETE         Capability = 1653
	Capability_CAP_VERSION_LIST       Capability = 1654
	Capability_CAP_VULN_REPORT_CREATE Capability = 1660
	Capability_CAP_VULN_REPORT_LIST   Capability = 1661
	Capability_CAP_VULN_CREATE        Capability = 1662
	// Custom Image Build
	Capability_CAP_BUILD_REPORT_LIST Capability = 1670
	// Global libraries capabilities
	Capability_CAP_LIBRARIES_ENTITLEMENTS_CREATE Capability = 1800
	Capability_CAP_LIBRARIES_ENTITLEMENTS_LIST   Capability = 1801
	Capability_CAP_LIBRARIES_ENTITLEMENTS_DELETE Capability = 1802
	Capability_CAP_LIBRARIES_ARTIFACTS_LIST      Capability = 1803
	// Ecosystems specific capabilities
	Capability_CAP_LIBRARIES_PYTHON_LIST       Capability = 1810
	Capability_CAP_LIBRARIES_PYTHON_CREATE     Capability = 1811
	Capability_CAP_LIBRARIES_JAVA_LIST         Capability = 1820
	Capability_CAP_LIBRARIES_JAVA_CREATE       Capability = 1821
	Capability_CAP_LIBRARIES_JAVASCRIPT_LIST   Capability = 1830
	Capability_CAP_LIBRARIES_JAVASCRIPT_CREATE Capability = 1831
	Capability_CAP_LIBRARIES_DOTNET_LIST       Capability = 1832
	Capability_CAP_LIBRARIES_DOTNET_CREATE     Capability = 1833
	Capability_CAP_LIBRARIES_GO_LIST           Capability = 1834
	Capability_CAP_LIBRARIES_GO_CREATE         Capability = 1835
	Capability_CAP_LIBRARIES_RUBY_LIST         Capability = 1836
	// Cache invalidation capability for the libraries cache (covers all ecosystems).
	// Granted to org owners and account admins; not to regular developer members.
	Capability_CAP_LIBRARIES_CACHE_INVALIDATE Capability = 1860
	// Read capability for the libraries resolution cache (status and entry
	// listing). Separate from CAP_LIBRARIES_ENTITLEMENTS_LIST on purpose: an
	// org's dependency-consumption history is sensitive data.
	Capability_CAP_LIBRARIES_CACHE_LIST Capability = 1862
	// Rebuilder API capabilities
	Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CREATE            Capability = 1840
	Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_LIST              Capability = 1841
	Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_CANCEL            Capability = 1842
	Capability_CAP_LIBRARIES_REBUILDER_REQUESTS_GROUP_UPDATE      Capability = 1843
	Capability_CAP_LIBRARIES_REBUILDER_ARTIFACTS_INVALIDATE       Capability = 1850
	Capability_CAP_LIBRARIES_REBUILDER_EXCLUSIONS_MANAGE          Capability = 1851
	Capability_CAP_LIBRARIES_REBUILDER_BUILDS_READ                Capability = 1852
	Capability_CAP_LIBRARIES_REBUILDER_BUILDS_TOKENS_FETCH        Capability = 1853
	Capability_CAP_LIBRARIES_REBUILDER_BUILDS_UNTRUSTED           Capability = 1854
	Capability_CAP_LIBRARIES_REBUILDER_REMEDIATED_ARTIFACTS_READ  Capability = 1855
	Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_READ          Capability = 1856
	Capability_CAP_LIBRARIES_REBUILDER_NEW_VERSIONS_REFRESH       Capability = 1857
	Capability_CAP_LIBRARIES_REBUILDER_MALWARE_STATUS_READ        Capability = 1858
	Capability_CAP_LIBRARIES_REBUILDER_CVE_REMEDIATIONS_LIST      Capability = 1859
	Capability_CAP_LIBRARIES_REBUILDER_CVE_REMEDIATIONS_UPDATE    Capability = 1861
	Capability_CAP_LIBRARIES_REBUILDER_SOURCE_COORDINATES_WRITE   Capability = 1863
	Capability_CAP_LIBRARIES_REBUILDER_SOURCE_COORDINATES_RESOLVE Capability = 1864
	// AWS Marketplace Subscriptions (Chainguard Libraries on AWS Security Hub Extended)
	Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_CREATE Capability = 1870
	Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_UPDATE Capability = 1871
	Capability_CAP_LIBRARIES_AWS_MARKETPLACE_SUBSCRIPTIONS_LIST   Capability = 1872
	// Library build requests: an organization asks Chainguard to build specific
	// library versions and tracks what it already has.
	//
	// Separate from the libraries.rebuilder.* capabilities above, which are
	// internal_only and are never grantable to a customer organization.
	Capability_CAP_LIBRARIES_REQUEST_GROUPS_CREATE Capability = 1874
	// list covers every read on a request group: the groups themselves, their
	// items, and the per-library view of them.
	Capability_CAP_LIBRARIES_REQUEST_GROUPS_LIST   Capability = 1875
	Capability_CAP_LIBRARIES_REQUEST_GROUPS_UPDATE Capability = 1876
	// delete covers draft groups only; removing a submitted group needs
	// delete_submitted.
	Capability_CAP_LIBRARIES_REQUEST_GROUPS_DELETE Capability = 1877
	// submit promotes a draft and carries the CVE-remediation opt-in for the group.
	// It is its own capability because submitting is restricted to owners, which a
	// field mask on update could not express.
	Capability_CAP_LIBRARIES_REQUEST_GROUPS_SUBMIT Capability = 1878
	// items.update covers draft item editing: remove, restore and per-item update.
	Capability_CAP_LIBRARIES_REQUEST_GROUPS_ITEMS_UPDATE Capability = 1879
	// Re-running a group's coverage check is expensive, and submitted groups are
	// refreshed automatically, so it is reserved for Chainguard support.
	Capability_CAP_LIBRARIES_REQUEST_GROUPS_REFRESH_COVERAGE Capability = 1880
	Capability_CAP_LIBRARIES_REQUEST_GROUPS_DELETE_SUBMITTED Capability = 1881
	// Remote registries: an org's configured upstream registries for virtual
	// repositories. Creating or deleting one changes where the org's builds
	// pull dependencies from, so both are owner-only alongside the library
	// policy capabilities; list is ordinary member read.
	Capability_CAP_LIBRARIES_REMOTE_REGISTRIES_CREATE Capability = 1882
	Capability_CAP_LIBRARIES_REMOTE_REGISTRIES_LIST   Capability = 1883
	Capability_CAP_LIBRARIES_REMOTE_REGISTRIES_DELETE Capability = 1884
	// Storage usage: how much storage an org's own uploads consume in each
	// language ecosystem. Owner-only because it is org-wide accounting (and the
	// basis for upcoming quotas), not something every member needs to see.
	Capability_CAP_LIBRARIES_STORAGE_USAGE_GET Capability = 1885
	// Registry Entitlements
	Capability_CAP_REGISTRY_ENTITLEMENTS_LIST          Capability = 1680
	Capability_CAP_REGISTRY_ENTITLEMENTS_CREATE        Capability = 1681
	Capability_CAP_REGISTRY_ENTITLEMENTS_DELETE        Capability = 1682
	Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_ADD    Capability = 1685
	Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_REMOVE Capability = 1686
	Capability_CAP_REGISTRY_ENTITLEMENTS_IMAGES_SWAP   Capability = 1687
	// Registry Settings
	Capability_CAP_REGISTRY_SETTINGS_LIST   Capability = 1683
	Capability_CAP_REGISTRY_SETTINGS_UPDATE Capability = 1684
	// Registry Overlays (tag-scoped Custom Assembly)
	Capability_CAP_REGISTRY_OVERLAYS_LIST Capability = 1688
	Capability_CAP_REGISTRY_OVERLAYS_EDIT Capability = 1689
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_CREATE Capability = 1701
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_UPDATE Capability = 1702
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_LIST Capability = 1703
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_DELETE Capability = 1704
	// Deprecated: Marked as deprecated in capabilities.proto.
	Capability_CAP_SIGSTORE_CERTIFICATE_CREATE Capability = 1705
	Capability_CAP_ADVISORIES_CREATE           Capability = 1900
	Capability_CAP_ADVISORIES_UPDATE           Capability = 1901
	Capability_CAP_ADVISORIES_LIST             Capability = 1902
	Capability_CAP_ADVISORIES_DELETE           Capability = 1903
	Capability_CAP_ADVISORIES_APPROVE          Capability = 1904
	// Registry Deployments
	Capability_CAP_REGISTRY_DEPLOYMENTS_CREATE Capability = 1950
	Capability_CAP_REGISTRY_DEPLOYMENTS_UPDATE Capability = 1951
	Capability_CAP_REGISTRY_DEPLOYMENTS_LIST   Capability = 1952
	// Policies
	Capability_CAP_POLICIES_POLICY_CREATE  Capability = 2001
	Capability_CAP_POLICIES_POLICY_UPDATE  Capability = 2002
	Capability_CAP_POLICIES_POLICY_LIST    Capability = 2003
	Capability_CAP_POLICIES_POLICY_DELETE  Capability = 2004
	Capability_CAP_POLICIES_BINDING_CREATE Capability = 2011
	Capability_CAP_POLICIES_BINDING_UPDATE Capability = 2012
	Capability_CAP_POLICIES_BINDING_LIST   Capability = 2013
	Capability_CAP_POLICIES_BINDING_DELETE Capability = 2014
	Capability_CAP_POLICIES_DECISION_LIST  Capability = 2015
	// Policy overrides waive enforcement for a specific artifact. These are
	// separate capabilities from binding management so they can be granted
	// independently. By default create and delete are held by org owners (like
	// binding management) and listing is available to viewers.
	Capability_CAP_POLICIES_OVERRIDE_CREATE   Capability = 2016
	Capability_CAP_POLICIES_OVERRIDE_LIST     Capability = 2017
	Capability_CAP_POLICIES_OVERRIDE_DELETE   Capability = 2018
	Capability_CAP_REPO_CHECK_POLICIES        Capability = 2020
	Capability_CAP_PACKAGES_ENTITLEMENTS_LIST Capability = 2100
	// Terms
	Capability_CAP_TERMS_ACCEPT Capability = 2201
	Capability_CAP_TERMS_LIST   Capability = 2202
	// This is orthogonal enough that we should leave
	// it somewhat separate, so add new capabilities above.
	// TODO(mattmoor): Think about whether we can encode specific
	// controller capabilities into our access control here?
	// e.g. could each logical controller/webhook be its own
	// capability?
	Capability_CAP_GULFSTREAM Capability = 10000
	// Guardener
	Capability_CAP_GUARDENER_DFC_CONVERT Capability = 2301
	// guardener.association.manage gates self-service linking/unlinking of a
	// GitHub org to a Chainguard group (the GroupAccountAssociations record).
	Capability_CAP_GUARDENER_ASSOCIATION_MANAGE Capability = 2302
	// guardener.association.list gates read-only listing of the GitHub org
	// installations linked to a Chainguard group (the read counterpart to
	// guardener.association.manage).
	Capability_CAP_GUARDENER_ASSOCIATION_LIST Capability = 2303
	// guardener.entitlement.manage gates the support-only surface for configuring a
	// group's guardener entitlement (e.g. which repo visibility scope guardener
	// responds to). It is internal_only: it can never be granted by a role
	// available to customer organizations.
	Capability_CAP_GUARDENER_ENTITLEMENT_MANAGE Capability = 2304
	// guardener.entitlement.list gates read-only access to a group's guardener
	// entitlement. Unlike guardener.entitlement.manage it is not internal_only, so
	// normal viewers can see the settings that apply to their group.
	Capability_CAP_GUARDENER_ENTITLEMENT_LIST Capability = 2305
	// Guardener actions migrator — on-demand enqueue of a repository's GitHub
	// Actions migration (opens a pull request), tracked via a long-running
	// operation. Mutating, so distinct from the read-only actions catalog cap.
	Capability_CAP_GUARDENER_ACTIONS_MIGRATE Capability = 2306
	// guardener.scan.list gates listing summaries of the dependency scans
	// guardener builds for the group's linked repositories.
	Capability_CAP_GUARDENER_SCAN_LIST Capability = 2307
	// guardener.scan.get gates reading one dependency scan by id (its declared
	// artifacts and their relationships).
	Capability_CAP_GUARDENER_SCAN_GET Capability = 2308
	// MCP tool calls
	Capability_CAP_MCP_TOOL_CALL Capability = 2401
	// Skills registry — publishing skill artifacts to skills.cgr.dev
	Capability_CAP_SKILLS_PUBLISH Capability = 2501
	// Skills registry entitlements
	Capability_CAP_SKILLS_ENTITLEMENTS_CREATE Capability = 2502
	Capability_CAP_SKILLS_ENTITLEMENTS_LIST   Capability = 2503
	Capability_CAP_SKILLS_ENTITLEMENTS_DELETE Capability = 2504
	// Skills catalog metadata table (description / license / category) backing
	// ListSkills/GetSkill and search. One org-agnostic set: per-org isolation is
	// the UIDP scope on each RPC, not separate caps. These gate the catalog
	// table's CRUD only; publishing skill artifacts to the registry stays
	// CAP_SKILLS_PUBLISH and entitlements stay CAP_SKILLS_ENTITLEMENTS_*.
	//
	// skills.list is customer-facing (read the catalog for orgs you can access).
	// The writes are internal_only: the catalog is populated by the Chainguard
	// publish pipeline, not by customer orgs, so a customer role can never be
	// granted them (a role carrying them must also grant CAP_INTERNAL).
	// skills.write is a single create-or-update cap: UpdateSkill is one
	// AIP-134 create-or-update RPC, so there is no separate create vs update.
	Capability_CAP_SKILLS_LIST   Capability = 2507
	Capability_CAP_SKILLS_WRITE  Capability = 2505
	Capability_CAP_SKILLS_DELETE Capability = 2506
	// Skills harden — access to the Skills harden API, split per RPC so read,
	// submit, and cancel can be granted independently. Customer-facing: an org
	// member holds these on the target group named by `chainctl skills harden
	// --group`.
	//   read   -> GetHardenOperation
	//   write  -> HardenSkill (submit)
	//   cancel -> CancelHardenOperation
	// These let a customer kick off and track a harden; they do NOT let the caller
	// write the hardened output. Publishing the hardened artifact and recording the
	// job result into the skills registry/catalog is done by internal identities
	// via the internal_only skills.write cap, and the pipeline's record-result RPC
	// is gated on CAP_INTERNAL — so a customer can never push into the hardened
	// area directly.
	Capability_CAP_SKILLS_HARDEN_READ   Capability = 2508
	Capability_CAP_SKILLS_HARDEN_WRITE  Capability = 2509
	Capability_CAP_SKILLS_HARDEN_CANCEL Capability = 2510
	// Argos — client-side encrypted document records.
	Capability_CAP_ARGOS_DOCUMENTS_CREATE Capability = 2601
	Capability_CAP_ARGOS_DOCUMENTS_LIST   Capability = 2602
	Capability_CAP_ARGOS_DOCUMENTS_DELETE Capability = 2603
	// Argos — documentation visibility. Grants read access to Argos API
	// documentation.
	Capability_CAP_ARGOS_DOCUMENTATION_READ Capability = 2615
	// Argos — Private OSV API (customer-facing OSV query surface).
	Capability_CAP_ARGOS_OSV_READ Capability = 2604
	Capability_CAP_ARGOS_OSV_DUMP Capability = 2614
	// Argos — identity types. Mutually exclusive: an identity holding both is
	// treated as a mitigation partner (the more restrictive of the two) for any
	// API call which varies the return value based on identity type.
	Capability_CAP_ARGOS_COALITION_MEMBER   Capability = 2616
	Capability_CAP_ARGOS_MITIGATION_PARTNER Capability = 2617
	// Argos — mitigation partner capabilities. request lets a partner submit
	// its capabilities and interests; approve lets staff review them.
	Capability_CAP_ARGOS_PARTNER_CAPABILITY_REQUEST Capability = 2618
	Capability_CAP_ARGOS_PARTNER_CAPABILITY_APPROVE Capability = 2619
	// Libraries Policy Gates — customer-facing policies and bindings that
	// configure the cooldown and malware gates applied to upstream package pulls,
	// plus the block events recorded when a pull is withheld.
	Capability_CAP_LIBRARIES_POLICY_CREATE           Capability = 2605
	Capability_CAP_LIBRARIES_POLICY_UPDATE           Capability = 2606
	Capability_CAP_LIBRARIES_POLICY_LIST             Capability = 2607
	Capability_CAP_LIBRARIES_POLICY_DELETE           Capability = 2608
	Capability_CAP_LIBRARIES_POLICY_BINDING_CREATE   Capability = 2609
	Capability_CAP_LIBRARIES_POLICY_BINDING_UPDATE   Capability = 2610
	Capability_CAP_LIBRARIES_POLICY_BINDING_LIST     Capability = 2611
	Capability_CAP_LIBRARIES_POLICY_BINDING_DELETE   Capability = 2612
	Capability_CAP_LIBRARIES_POLICY_BLOCK_EVENT_LIST Capability = 2613
	// Build API
	Capability_CAP_BUILDAPI_BUILD_CREATE Capability = 2701
	Capability_CAP_BUILDAPI_BUILD_LIST   Capability = 2702
	Capability_CAP_BUILDAPI_WORKER_SYNC  Capability = 2703
	Capability_CAP_BUILDAPI_BUILD_CANCEL Capability = 2704
	// Cassie REAPI cache surface. CAS (blobs + ByteStream) and the ActionCache
	// are separately gated: a caller may read or write action results without
	// any authority over the underlying content blobs, and vice versa.
	Capability_CAP_CASSIE_CAS_READ  Capability = 2801
	Capability_CAP_CASSIE_CAS_WRITE Capability = 2802
	Capability_CAP_CASSIE_AC_READ   Capability = 2804
	Capability_CAP_CASSIE_AC_WRITE  Capability = 2803
	// Loggie: the live-log service. Readers tailing a stream hold logs.read;
	// a producer appending to its streams holds logs.write; the orchestrator
	// issuing streams holds logs.create. Appending also requires the stream's
	// signed write name, so a logs.write holder can only append to streams it
	// was handed.
	Capability_CAP_LOGGIE_LOGS_READ   Capability = 2901
	Capability_CAP_LOGGIE_LOGS_WRITE  Capability = 2902
	Capability_CAP_LOGGIE_LOGS_CREATE Capability = 2903
	// Rex: the remote-execution service. The edge authorizes submitting an
	// execution; the scheduler authorizes a worker joining the pool; the
	// executions query surface authorizes cross-run reads at the instance.
	Capability_CAP_REX_EXECUTIONS_CREATE Capability = 2705
	Capability_CAP_REX_EXECUTIONS_LIST   Capability = 2706
	Capability_CAP_REX_WORKERS_CONNECT   Capability = 2707
	// Gated platform classes. USE authorizes submitting an execution that
	// demands a gated class; SERVE authorizes a worker pool advertising one.
	// Both are evaluated at the class's own UIDP node, never at the instance.
	Capability_CAP_REX_CLASS_USE   Capability = 2708
	Capability_CAP_REX_CLASS_SERVE Capability = 2709
	// Actions catalog — the read-only catalog of Chainguard-published GitHub
	// Actions and the upstreams they mirror. Writes are internal (importer only).
	Capability_CAP_ACTIONS_LIST Capability = 2700
	// Recording the dependency edges of a composite action's revision, i.e. the
	// `uses:` steps of its action.yml. Internal only: the edges are derived by
	// the hardening pipeline that reads the action.yml, and are not something a
	// customer asserts about the shared graph.
	Capability_CAP_ACTIONS_DEPENDENCIES_UPDATE Capability = 2710
	// Reading the dependency graph. Internal only: reads are fenced to groups the
	// caller holds a capability in, which no customer does for these actions.
	Capability_CAP_ACTIONS_DEPENDENCIES_LIST Capability = 2711
	// Sandbox: the ACID sandbox Runs control plane (the WorkflowRuns API,
	// ai-cicd/sandbox). Customer-grantable — an org's members run, watch, and
	// cancel workflow runs in the org's own instance — via the sandbox.user
	// role, and held by Owners. The SANDBOX service principal's internal
	// sandbox.service_agent role carries the same capabilities.
	Capability_CAP_SANDBOX_RUN_CREATE Capability = 3001
	Capability_CAP_SANDBOX_RUN_LIST   Capability = 3002
	Capability_CAP_SANDBOX_RUN_CANCEL Capability = 3003
)

func Parse 

func Parse(name string) (Capability, error)

Parse resolves a capability's string name (e.g. "groups.list") to its enum value. Parse never returns a non-nil error; the error result is retained for API compatibility. Unknown names return (Capability_UNKNOWN, nil), so callers must check for Capability_UNKNOWN explicitly; UNKNOWN is never granted, so unresolvable input fails closed at the caller.

The name map is built once from this binary's own compiled-in enum table. An enum value whose (name) option cannot be read is a generated-code inconsistency, not runtime data — TestRoundTrip rejects it in CI. If such a binary ships anyway, the value is logged at error level and omitted from the map, so its name resolves to UNKNOWN and resolution of every other name is unaffected — the same per-value scoping as StringifyAllContext and Bitify (CUS-843), rather than failing every Parse call in the process.

Example

ExampleParse demonstrates parsing a capability by name. 

package main

import (
	"fmt"

	"chainguard.dev/sdk/proto/capabilities"
)

func main() {
	// Capability_UNKNOWN is the zero value and is not in the name map.
	capability, err := capabilities.Parse("unknown-capability-name")
	fmt.Println(err)
	fmt.Println(capability == capabilities.Capability_UNKNOWN)
}

Output:
<nil>
true

func SortCaps added in v0.1.36 

func SortCaps(caps ...[]Capability) []Capability

func (Capability) Descriptor 

func (Capability) Descriptor() protoreflect.EnumDescriptor

func (Capability) Enum 

func (x Capability) Enum() *Capability

func (Capability) EnumDescriptor deprecated 

func (Capability) EnumDescriptor() ([]byte, []int)

Deprecated: Use Capability.Descriptor instead.

func (Capability) Number 

func (x Capability) Number() protoreflect.EnumNumber

func (Capability) String 

func (x Capability) String() string

func (Capability) Type 

func (Capability) Type() protoreflect.EnumType

type Set 

type Set []Capability

Set performs efficient encoding of a list of capabilities.

func (Set) MarshalJSON 

func (s Set) MarshalJSON() ([]byte, error)

MarshalJSON implements json.Marshaler

func (Set) String 

func (s Set) String() string

String renders the set for diagnostics. Values missing from this binary's enum (deleted, or newer than this build) render as "unknown(cap=N)" and any other Stringify failure as "error(cap=N)", mirroring StringifyAllContext's two cases while keeping malformed values visible instead of silently dropping them.

func (*Set) UnmarshalJSON 

func (s *Set) UnmarshalJSON(b []byte) error

UnmarshalJSON implements json.Unmarshaler

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.