// the workload ports are working correctly.
				{
					name: "DISABLE",
					config: `apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: mtls
spec:
  mtls:
    mode: DISABLE`,
					expected: []expect{
						{
							port:              ports.TCPWorkloadOnly,
							plaintextSucceeds: true,

      - prefix(istio.io/) # Groups all imports with the specified Prefix.
  gocritic:
    # Disable all checks.
    # Default: false
    disable-all: true
    # Which checks should be enabled in addition to default checks. Since we don't want
    # all of the default checks, we do the disable-all first.
    enabled-checks:
      - appendCombine
      - argOrder
      - assignOp
      - badCond

=== Disable for a build

To disable the Daemon for a single build, pass the `--no-daemon` flag when you run a build:

----
$ gradle <task> --no-daemon
----

This flag overrides any settings that enable the Daemon in your project including the `gradle.properties` files.

=== Disable for a project

					},
				},
			},
		},
		{
			name: "disable-accesslog",
			push: env.PushContext(),
			proxy: &model.Proxy{
				ConfigNamespace: "default",
				Labels:          map[string]string{"app": "test-disable-accesslog"},
				Metadata:        &model.NodeMetadata{Labels: map[string]string{"app": "test-disable-accesslog"}},
			},
			tcp:      &tcp.TcpProxy{},

   matchLabels:
     app: foo
 mtls:
   mode: STRICT
 portLevelMtls:
   9000:
     mode: DISABLE
---`
	paDisableWithStrictOnPort9000 := `
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
 name: default
spec:
 selector:
   matchLabels:
     app: foo
 mtls:
   mode: DISABLE
 portLevelMtls:
   9000:
     mode: STRICT
---`
	paDisableWithPermissiveOnPort9000 := `

				},
				{
					name: "global mtls disabled",
					configs: config.Sources{
						config.File("testdata/reachability/global-peer-authn.yaml.tmpl"),
						config.File("testdata/reachability/global-dr.yaml.tmpl"),
					}.WithParams(param.Params{
						mtlsModeParam:            model.MTLSDisable.String(),
						tlsModeParam:             "DISABLE",
						param.Namespace.String(): systemNS,
					}),

        }
    }

    @Nullable
    public static <T> T whileDisabled(Factory<T> factory) {
        disable();
        try {
            return factory.create();
        } finally {
            maybeEnable();
        }
    }

    public static void whileDisabled(Runnable action) {
        disable();
        try {
            action.run();
        } finally {
            maybeEnable();
        }

function get-credentials {
  # shellcheck disable=SC2086
  curl ${CURL_FLAGS} \
    -H "Metadata-Flavor: Google" \
    "${GCE_METADATA_INTERNAL}/service-accounts/default/token" \
  | python3 -c 'import sys; import json; print(json.loads(sys.stdin.read())["access_token"])'
}

function valid-storage-scope {
  # shellcheck disable=SC2086
  curl ${CURL_FLAGS} \
    -H "Metadata-Flavor: Google" \

    - "^zz_generated.*"

output:
  sort-results: true

issues:
  max-issues-per-linter: 0
  max-same-issues: 0

  # The default excludes disable the "should have comment or be unexported" check from revive.
  # We want that to be enabled, therefore we have to disable all default excludes and
  # add those back one-by-one that we want. See https://github.com/golangci/golangci-lint/issues/456#issuecomment-617470264

	FlagD             = flag.Bool("d", false, "disable dynamic executable")
	flagF             = flag.Bool("f", false, "ignore version mismatch")
	flagG             = flag.Bool("g", false, "disable go package data checks")
	flagH             = flag.Bool("h", false, "halt on error")
	flagN             = flag.Bool("n", false, "no-op (deprecated)")
	FlagS             = flag.Bool("s", false, "disable symbol table")