}},
			ExpectAllow:       true,
			ExpectAnnotations: map[string]string{"allow.example.com/key1": "value1"},
		},
		{
			Name: "match & disallow",
			Webhooks: []registrationv1.ValidatingWebhook{{
				Name:                    "disallow",
				ClientConfig:            ccfgSVC("disallow"),
				Rules:                   matchEverythingRules,
				NamespaceSelector:       &metav1.LabelSelector{},

				return fmt.Errorf("parsing $CGO_%s_DISALLOW: %v", name, err)
			}
			disallow = r
		}
	}

Args:
	for i := 0; i < len(list); i++ {
		arg := list[i]
		if disallow != nil && disallow.FindString(arg) == arg {
			goto Bad
		}
		if allow != nil && allow.FindString(arg) == arg {
			continue Args
		}
		for _, re := range invalid {
			if re.FindString(arg) == arg { // must be complete match
				goto Bad

    }

    void "can disallow packages"() {
        given:
        withSpec { FilteringClassLoader.Spec spec ->
            spec.disallowPackage("org.junit")
        }

        expect:
        cannotLoadClass(Test)
        cannotSeePackage("org.junit")
        cannotSeePackage("org.junit.subpackage")
    }

    void "disallow wins over allow packages"() {
        given:

        if ( prop == null ) {
            return;
        }
        Set<String> disallow = new HashSet<>();
        StringTokenizer st = new StringTokenizer(prop, ",");
        while ( st.hasMoreTokens() ) {
            disallow.add(st.nextToken().trim());
        }
        this.disallowCompound = disallow;
    }


    protected void initDefaults () throws CIFSException {

        try {

        }
        if (type.getSuperclass() != null) {
            visitFields(type.getSuperclass(), collector);
        }

        // Disallow instance fields. This doesn't guarantee that the object is immutable, just makes it less likely
        // We might tighten this constraint to also disallow any _code_ on immutable types that reaches out to static state
        for (Field field : type.getDeclaredFields()) {

		// Entire set of ASCII punctuation, from which we remove characters:
		//     ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~
		// We disallow some shell special characters: " ' * < > ? ` |
		// (Note that some of those are disallowed by the Windows file system as well.)
		// We also disallow path separators / : and \ (fileNameOK is only called on path element characters).
		// We allow spaces (U+0020) in file names.

    xargs -L 100 go mod edit -fmt

    go mod tidy -v

    # disallow transitive dependencies on k8s.io/kubernetes
    loopback_deps=()
    kube::util::read-array loopback_deps < <(go list all 2>/dev/null | grep k8s.io/kubernetes/ || true)
    if (( "${#loopback_deps[@]}" > 0 )); then

//
// The remote service is expected to fill the SubjectAccessReviewStatus field to either allow or
// disallow access. A permissive response would return:
//
//	{
//	  "apiVersion": "authorization.k8s.io/v1beta1",
//	  "kind": "SubjectAccessReview",
//	  "status": {
//	    "allowed": true
//	  }
//	}
//
// To disallow access, the remote service would return:
//
//	{
//	  "apiVersion": "authorization.k8s.io/v1beta1",

                workerLeases.runAsWorkerThread(() -> {
                    if (allowAccessToProjectState) {
                        return doRunBatch(firstOperation);
                    } else {
                        // Disallow this thread from making any changes to the project locks while it is running the work. This implies that this thread will not

        """

        when:
        fails('broken')

        then:
        failure.assertHasCause("The value for this file collection is final and cannot be changed any further.")
    }

    def "can disallow changes to file collection without finalizing value"() {
        buildFile """
            def files = objects.fileCollection()
            def name = 'other'
            files.from { name }