expect(path, false, ['HEAD'], fileHandler(path, srcFile), new DefaultPasswordCredentials(username, password))
    }

    /**
     * Forbids one GET request for the given URL.
     */
    HttpResourceInteraction forbidGet(String path) {
        return forbid(path, false, ['GET'], ok())
    }

    /**
     * Allows one GET request for the given URL. Reads the request content from the given file.
     */

		// As long the as the invocations are "far enough apart in time", this usually won't happen.
		//
		// TODO: for Forbid, we could use the same name for every execution, as a lock.
		// With replace, we could use a name that is deterministic per execution time.
		// But that would mean that you could not inspect prior successes or failures of Forbid jobs.

	if v == nil {
		return nil
	}

	allErrs := field.ErrorList{}

	// We still unconditionally forbid XValidations in quantifiers, the only
	// quantifier that is allowed to have right now is AllOf. This is due to
	// implementation constraints - the SchemaValidator would need to become

                constraint("org:bar:{strictly 1.0}", "org:bar:1.0")
            }
        }
    }

    // TODO: This is not desired behavior. We should deprecate and forbid this.
    def "can consume non-consumable project configuration when substituted as a transitive dependency"() {

        file("included/settings.gradle") << """
            rootProject.name = "transitive"
        """

        HTTP_BAD_METHOD,
        HTTP_GONE,
        HTTP_REQ_TOO_LONG,
        HTTP_NOT_IMPLEMENTED,
        HTTP_PERM_REDIRECT,
        -> {
          // These codes can be cached unless headers forbid it.
        }

        HTTP_MOVED_TEMP,
        HTTP_TEMP_REDIRECT,
        -> {
          // These codes can only be cached with the right response headers.

          # this restriction. Whether we then do a global search/replace remains
          # to be decided.
          with-helpers .*
  forbidigo:
    analyze-types: true
    forbid:
    - p: ^managedfields\.ExtractInto$
      pkg: ^k8s\.io/apimachinery/pkg/util/managedfields$
      msg: should not be used because managedFields was removed
    - p: \.Extract

	for label := range modifiedLabels {
		namespace := getLabelNamespace(label)
		// forbid kubelets from setting node-restriction labels
		if namespace == v1.LabelNamespaceNodeRestriction || strings.HasSuffix(namespace, "."+v1.LabelNamespaceNodeRestriction) {
			forbiddenLabels.Insert(label)
		}
		// forbid kubelets from setting unknown kubernetes.io and k8s.io labels on update

     * by concurrently running mojo executions. To prevent race conditions, an aggregating execution will block
     * all other executions until finished.
     * We also lock on a given project to forbid a forked lifecycle to be executed concurrently with the project.
     * TODO: ideally, the builder should take care of the ordering in a smarter way
     * TODO: and concurrency issues fixed with MNG-7157
     */

				Resource:        "pods",
				Subresource:     "status",
				Name:            "mypods",
				Namespace:       "myns",
				APIGroup:        "",
				APIVersion:      "v1",
			},
		},
		{
			"forbid educate dolphins",
			authorizer.AttributesRecord{
				ResourceRequest: true,
				User:            nodeUser,
				Verb:            "educate",
				Resource:        "dolphins",
				Subresource:     "",

	// +optional
	StartingDeadlineSeconds *int64

	// Specifies how to treat concurrent executions of a Job.
	// Valid values are:
	//
	// - "Allow" (default): allows CronJobs to run concurrently;
	// - "Forbid": forbids concurrent runs, skipping next run if previous run hasn't finished yet;
	// - "Replace": cancels currently running job and replaces it with a new one
	// +optional
	ConcurrencyPolicy ConcurrencyPolicy