feat: add new analysis status and cvss version fields

protos/grafeas/v1/cvss.proto

@@ -157,3 +157,10 @@ message CVSS {
     IMPACT_NONE = 3;
   }
 }
+
+// CVSS Version.
+enum CVSSVersion {
+  CVSS_VERSION_UNSPECIFIED = 0;
+  CVSS_VERSION_2 = 1;
+  CVSS_VERSION_3 = 2;
+}

protos/grafeas/v1/discovery.proto

@@ -53,6 +53,8 @@ message DiscoveryOccurrence {
   // Analysis status for a resource. Currently for initial analysis only (not
   // updated in continuous analysis).
   enum AnalysisStatus {
+    option allow_alias = true;
+
     // Unknown.
     ANALYSIS_STATUS_UNSPECIFIED = 0;
     // Resource is known but no action has been taken yet.
@@ -61,16 +63,30 @@ message DiscoveryOccurrence {
     SCANNING = 2;
     // Analysis has finished successfully.
     FINISHED_SUCCESS = 3;
+    // Analysis has completed.
+    COMPLETE = 3;
     // Analysis has finished unsuccessfully, the analysis itself is in a bad
     // state.
     FINISHED_FAILED = 4;
-    // The resource is known not to be supported
+    // The resource is known not to be supported.
     FINISHED_UNSUPPORTED = 5;
   }
 
   // The status of discovery for the resource.
   AnalysisStatus analysis_status = 2;
 
+  // Indicates which analysis completed successfully. Multiple types of
+  // analysis can be performed on a single resource.
+  message AnalysisCompleted {
+    repeated string analysis_type = 1;
+  }
+
+  AnalysisCompleted analysis_completed = 7;
+
+  // Indicates any errors encountered during analysis of a resource. There
+  // could be 0 or more of these errors.
+  repeated google.rpc.Status analysis_error = 8;
+
   // When an error is encountered this will contain a LocalizedMessage under
   // details to show to the user. The LocalizedMessage is output only and
   // populated by the API.

protos/grafeas/v1/vulnerability.proto

@@ -148,6 +148,11 @@ message VulnerabilityNote {
   // upstream timestamp from the underlying information source - e.g. Ubuntu
   // security tracker.
   google.protobuf.Timestamp source_update_time = 6;
+
+  // CVSS version used to populate cvss_score and severity.
+  grafeas.v1.CVSSVersion cvss_version = 7;
+
+  // Next free ID is 8.
 }
 
 // An occurrence of a severity vulnerability on a resource.
@@ -238,4 +243,9 @@ message VulnerabilityOccurrence {
   // Output only. Whether at least one of the affected packages has a fix
   // available.
   bool fix_available = 9;
+
+  // Output only. CVSS version used to populate cvss_score and severity.
+  grafeas.v1.CVSSVersion cvss_version = 11;
+
+  // Next free ID is 12.
 }