Disclaimer: I have NO container_analysis experience, but have used this repo before :) Here's how running this went:

-Pretty please add a README so users know how you want them to run your code (that they need to install the requirements, let them know what needs to be enabled in their GCP Project, etc., any environment vars). Given that I've never used container analysis, I failed a bunch before I was able to successfully run stuff

• When running pip install -r requirements.txt in a virtual environment on your branch, I run into this dependency error (although when I pulled the upstream into my clone of your repo and rebased your work on top of it, it was okay)

ERROR: grafeas 0.1.0 has requirement google-api-core[grpc]<2.0.0dev,>=1.6.0, but you'll have google-api-core 0.1.4 which is incompatible.
ERROR: google-cloud-containeranalysis 0.1.0 has requirement google-api-core[grpc]<2.0.0dev,>=1.4.1, but you'll have google-api-core 0.1.4 which is incompatible.

• the test_pubsub failed for me with a 404 resource not found resource=container-analysis-occurrences-v1beta1 - this is probably on me, and a README may have helped me not mess this up, but in case it's not me, double check that this test can run independently of the others

@leahecole I added a README, let me know if that looks better. Your pubsub issues may have been because the team recently switched from the beta topic to the GA one, so I updated the sample to use the new topic. Let me know what you think

Note that the tests aren't actually running, since this PR is based on a fork. I forgot that quirk of this repo

Maybe after we resolve these comments I can close this and open another one as an internal branch? Let me know what you think

Ooo I forgot that's a quirk of this repo also. @dansanche I think that after resolution, opening another one and linking it here in the comments is a fabulous idea.

@leahecole I believe I resolved the issues you mentioned, except setting application credentials. Let me know if you think that should be added

Sorry, didn't process that properly. I think adding the application creds is a good idea because right now it throws a warning if you don't

sounds good, I'll add it to the new PR