switch event.Event {
	case controllers.EventAdd:
		// pod was added to our cache
		// we get here in 2 cases:
		// 1. new pod was created on our node
		// 2. we were restarted and current existing pods are added to our cache

		// We have no good way to distinguish between these two cases from here. But we don't need to!
		// Existing pods will be handled by the dataplane using `GetAmbientPods`,

		case isSysErrPathNotFound(err):
			// This is a special case should be handled only for
			// windows, because windows API does not return "not a
			// directory" error message. Handle this specifically
			// here.
			return errFileAccessDenied
		}
	}
	return err
}

// Reliably retries os.RemoveAll if for some reason os.RemoveAll returns
// syscall.ENOTEMPTY (children has files).

    // contract to guarantee ordering among runnables we'd have to modify the logic here to allow
    // it.
    executeListener(runnable, executor);
  }

  /**
   * Runs this execution list, executing all existing pairs in the order they were added. However,
   * note that listeners added after this point may be executed before those previously added, and

      with:
        languages: ${{ matrix.language }}
        tools: latest
        # If you wish to specify custom queries, you can do so here or in a config file.
        # By default, queries listed here will override any specified in a config file.
        # Prefix the list here with "+" to use these queries and those in the config file.
        # queries: ./path/to/local/query, your-org/your-repo/queries@main

  @SuppressWarnings("unchecked")
  public static <T extends @Nullable Object> Collector<T, ?, T> onlyElement() {
    return (Collector) ONLY_ELEMENT;
  }

  /**
   * This atrocity is here to let us report several of the elements in the stream if there were more
   * than one, not just two.
   */
  private static final class ToOptionalState {
    static final int MAX_EXTRAS = 4;

    @CheckForNull Object element;

		return svc.Name
	}

	return "NA" // Shouldn't normally reach here
}

func serviceWaypointName(svc *ZtunnelService, services map[string]*ZtunnelService) string {
	if svc.Waypoint == nil {
		return "None"
	}

	if svc, ok := services[svc.Waypoint.Destination]; ok {
		return svc.Name
	}

	return "NA" // Shouldn't normally reach here

// createHostsideProbeIpset creates an ipset. This is designed to be called from the host netns.
// Note that if the ipset already exist by name, Create will not return an error.
//
// We will unconditionally flush our set before use here, so it shouldn't matter.
func createHostsideProbeIpset(isV6 bool) (ipset.IPSet, error) {
	linDeps := ipset.RealNlDeps()
	probeSet, err := ipset.NewIPSet(iptables.ProbeIPSet, isV6, linDeps)
	if err != nil {

    if (os == Os.LINUX) {
        steps {
            script {
                // Because we exclude tests in `distributions-integ-tests` below, `@Flaky` won't work in that subproject.
                // Here we check the existence of `@Flaky` annotation to make sure nobody use that annotation in `distributions-integ-tests` subproject.
                name = "MAKE_SURE_NO_@FLAKY_IN_DISTRIBUTIONS_INTEG_TESTS"

          #   - See https://github.com/ossf/scorecard-action#publishing-results.
          # For private repositories:
          #   - `publish_results` will always be set to `false`, regardless
          #     of the value entered here.
          publish_results: true

      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"

		export GOARCH=arm
		export GOARM=5
	fi

	# Build and vet everything.
	# cmd/go/internal/work/exec.go enables the same vet flags during go test of std cmd
	# and should be kept in sync with any vet flag changes here.
	if ! "$GOROOT/bin/go" build std cmd || ! "$GOROOT/bin/go" vet -unsafeptr=false std cmd; then
		failed=true
		if $sete; then
			exit 1
		fi
	fi
done

if [ "$failed" = "true" ]; then
	echo "" 1>&2