// Run our actual test code. In this case, we are just checking nothing crashes.
    // In other tests, explicit assertions may be helpful.
    policies := push.AuthzPolicies.ListAuthorizationPolicies(selectionOpts)
    New(bundle, push, policies, option).BuildHTTP()
  })
}
```

## Running tests

Fuzz tests can be run using standard Go tooling:

```shell
go test ./path/to/pkg -v -run=^$ -fuzz=Fuzz

release=$(git describe --abbrev=0 --tags)

docker buildx build --push --no-cache \
	--build-arg RELEASE="${release}" \
	-t "minio/minio:latest" \
	-t "quay.io/minio/minio:latest" \
	-t "minio/minio:${release}" \
	-t "quay.io/minio/minio:${release}" \
	--platform=linux/arm64,linux/amd64,linux/ppc64le,linux/s390x \
	-f Dockerfile.release .

docker buildx prune -f

docker buildx build --push --no-cache \
	--build-arg RELEASE="${release}" \

		c := fuzz.Struct[*cluster.Cluster](fg)

		serviceDiscovery := memory.NewServiceDiscovery()
		env := newTestEnvironment(serviceDiscovery, mesh, buildEnvoyFilterConfigStore(patches))
		push := model.NewPushContext()
		push.InitContext(env, nil, nil)
		efw := push.EnvoyFilters(proxy)
		ApplyClusterMerge(networking.EnvoyFilter_GATEWAY, efw, c, []host.Name{host.Name(hostname)})
	})

func (g *GrpcConfigGenerator) BuildClusters(node *model.Proxy, push *model.PushContext, names []string) model.Resources {
	filter := newClusterFilter(names)
	clusters := make([]*cluster.Cluster, 0, len(names))
	for defaultClusterName, subsetFilter := range filter {
		builder, err := newClusterBuilder(node, push, defaultClusterName, subsetFilter)
		if err != nil {
			log.Warn(err)
			continue
		}

	// This is only an escape hatch for a lack of complete mapping of "Input changed -> Output changed".
	// WDS does not suffer this limitation, so we could almost safely ignore these.
	// However, other code will merge "Partial push + Full push -> Full push", so skipping full pushes isn't viable.

		fg := fuzz.New(t, data)
		proxy := fuzz.Struct[*model.Proxy](fg)
		to := fuzz.Struct[TestOptions](fg)
		lb := fuzz.Struct[*ListenerBuilder](fg)
		cg := NewConfigGenTest(t, to)
		lb.node = cg.SetupProxy(proxy)
		lb.push = cg.PushContext()
		cg.ConfigGen.buildGatewayListeners(lb)
	})
}

func FuzzBuildSidecarOutboundHTTPRouteConfig(f *testing.F) {
	f.Fuzz(func(t *testing.T, patchCount int, hostname string, data []byte) {

		// TODO: send different version for incremental eds
		VersionInfo: req.Push.PushVersion,
		Nonce:       nonce(req.Push.LedgerVersion),
		Resources:   xds.ResourcesToAny(res),
	}

	configSize := ResourceSize(res)
	configSizeBytes.With(typeTag.Value(w.TypeUrl)).Record(float64(configSize))

	ptype := "PUSH"
	if logdata.Incremental {
		ptype = "PUSH INC"
	}

	if err := xds.Send(con, resp); err != nil {

	proxy        *model.Proxy
}

func NewBuilder(push *model.PushContext, proxy *model.Proxy) *Builder {
	return NewBuilderForService(push, proxy, nil)
}

func NewBuilderForService(push *model.PushContext, proxy *model.Proxy, svc *model.Service) *Builder {
	applier := authn.NewPolicyApplier(push, proxy, svc)
	trustDomains := TrustDomainsForValidation(push.Mesh)
	return &Builder{
		applier:      applier,

    func::FuncOp root, SymbolTable &symtab,
    const std::function<bool(SymbolUserOpInterface)> &predicate,
    llvm::SmallVector<SymbolUserOpInterface> &ops) {
  std::stack<func::FuncOp> worklist;
  worklist.push(root);
  while (!worklist.empty()) {
    func::FuncOp u = worklist.top();
    worklist.pop();
    auto result = u.walk([&](SymbolUserOpInterface op) {
      if (llvm::isa<T, Types...>(op) && (!predicate || predicate(op))) {

					pushes[proxy.ID()]++
					pushesMu.Unlock()
				case <-stopCh:
					return
				}
			}
		}()
	}
	go doSendPushes(stopCh, semaphore, queue)

	for push := 0; push < 100; push++ {
		for _, proxy := range proxies {
			queue.Enqueue(proxy, &model.PushRequest{Push: &model.PushContext{}})
		}
		time.Sleep(time.Millisecond * 10)
	}
	for queue.Pending() > 0 {
		time.Sleep(time.Millisecond)
	}
	pushesMu.Lock()