base.Fatalf("go: %s already exists", gowork)
	}

	goV := gover.Local() // Use current Go version by default
	wf := new(modfile.WorkFile)
	wf.Syntax = new(modfile.FileSyntax)
	wf.AddGoStmt(goV)
	workUse(ctx, gowork, wf, args)
	modload.WriteWorkFile(gowork, wf)

}

// Verify returns true if the passed workload matches the filter fields
func (wf *WorkloadFilter) Verify(workload *ZtunnelWorkload) bool {
	if wf.Address == "" && wf.Node == "" && wf.Namespace == "" {
		return true
	}

	if wf.Namespace != "" {
		if !strings.EqualFold(workload.Namespace, wf.Namespace) {
			return false
		}
	}

	if wf.Address != "" {
		var find bool
		for _, ip := range workload.WorkloadIPs {

}

// FromGoWork returns the go version from the go.mod file.
// It returns DefaultGoWorkVersion if the go.mod file does not contain a go line or if wf is nil.
func FromGoWork(wf *modfile.WorkFile) string {
	if wf == nil || wf.Go == nil {
		return DefaultGoWorkVersion
	}
	return wf.Go.Version

	}
	wf, err := modload.ReadWorkFile(gowork)
	if err != nil {
		base.Fatal(err)
	}
	workUse(ctx, gowork, wf, args)
	modload.WriteWorkFile(gowork, wf)
}

func workUse(ctx context.Context, gowork string, wf *modfile.WorkFile, args []string) {
	workDir := filepath.Dir(gowork) // absolute, since gowork itself is absolute

type PolicyFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *PolicyFilter) Verify(pol *ZtunnelPolicy) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(pol.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

		}
		goV = gover.Max(goV, modload.MainModules.GoVersion())
	}

	wf, err := modload.ReadWorkFile(workFilePath)
	if err != nil {
		base.Fatal(err)
	}
	modload.UpdateWorkGoVersion(wf, goV)
	modload.UpdateWorkFile(wf)
	if err := modload.WriteWorkFile(workFilePath, wf); err != nil {
		base.Fatal(err)
	}

				}
				util.CompareContent(t, gotOut.Bytes(), tt.wantOutputSecret)
			}
			if tt.wantOutputWorkload != "" {
				wf := WorkloadFilter{}
				if tt.configNamespace != "" {
					wf.Namespace = tt.configNamespace
				}
				err := cw.PrintWorkloadSummary(wf)
				if err == nil && tt.wantErr {
					t.Errorf("PrintWorkloadSummary (%v) did not produce expected err", tt.name)

		return off
	}

	wp1 := []byte{1, 2}
	ws := &WriteSeeker{}

	// write some stuff
	wf(t, ws, wp1)
	// check that BytesWritten returns what we wrote.
	sleq(t, ws.BytesWritten(), wp1)
	// offset is at end of slice, so reading should return zero bytes.
	rf(t, ws, []byte{})

	// write some more stuff
	wp2 := []byte{7, 8, 9}
	wf(t, ws, wp2)
	// check that BytesWritten returns what we expect.
	wpex := []byte{1, 2, 7, 8, 9}

type ServiceFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *ServiceFilter) Verify(svc *ZtunnelService) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(svc.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

	rval := ""
	for _, f := range want {
		wf := "Func: " + f + "\n"
		if strings.Contains(output, wf) {
			continue
		}
		rval += fmt.Sprintf("error: output should contain %q but does not\n", wf)
	}
	for _, f := range avoid {
		wf := "Func: " + f + "\n"
		if strings.Contains(output, wf) {
			rval += fmt.Sprintf("error: output should not contain %q but does\n", wf)
		}
	}
	if rval != "" {