var startDebounce time.Time
	var lastConfigUpdateTime time.Time

	pushCounter := 0
	debouncedEvents := 0

	// Keeps track of the push requests. If updates are debounce they will be merged.
	combinedEvents := sets.New[T]()

	free := true
	freeCh := make(chan struct{}, 1)

	push := func(events sets.Set[T], debouncedEvents int, startDebounce time.Time) {
		pushFn(events)
		freeCh <- struct{}{}
	}

```
λ CRED_DIR=/media/builder/minio make hotfix-push
```

#### Builds the hotfix container and pushes to docker.io/minio/minio

```
λ CRED_DIR=/media/builder/minio make docker-hotfix-push
```

#### Builds the hotfix container and pushes to registry.min.dev/<customer>/minio

```
λ REPO="registry.min.dev/<customer>" CRED_DIR=/media/builder/minio make docker-hotfix-push
```

        where:
        localStore | localEnabled | config
        true       | true         | "remote($remoteCacheClass) { push = true }"
        false      | true         | "local.push = false; remote($remoteCacheClass) { push = true }"
        false      | false        | "local.enabled = false; remote($remoteCacheClass) { push = true }"
    }

    def "records ops for remote hit"() {

# See the License for the specific language governing permissions and
# limitations under the License.

HUB ?= gcr.io/istio-testing/jwt-server
TAG ?= 0.7

push: main.go Dockerfile

					IsCustomBuilder: tc.meshConfig != nil,
					UseExtendedJwt:  extended,
				}
				push := push(t, baseDir+tc.input, tc.meshConfig)
				proxy := node(tc.version)
				selectionOpts := model.PolicyMatcherForProxy(proxy)
				policies := push.AuthzPolicies.ListAuthorizationPolicies(selectionOpts)
				g := New(tc.tdBundle, push, policies, option)
				if g == nil {
					t.Fatalf("failed to create generator")
				}

The Push Queue is mostly a normal queue, but it has some special logic to merge push requests for each given proxy. This results in each proxy having 0 or 1 outstanding push requests; if additional updates come in the existing push request is just expanded.

Another job polls this queue and triggers each client to start a push.

```mermaid
graph TD
    subgraph Config Flow

		authnBuilder = authn.NewBuilderForService(lb.push, lb.node, svc)
		authzBuilder = authz.NewBuilderForService(authz.Local, lb.push, lb.node, true, svc)
		authzCustomBuilder = authz.NewBuilderForService(authz.Custom, lb.push, lb.node, true, svc)
	}

	// TODO: consider dedicated listener class for waypoint filters
	cls := istionetworking.ListenerClassSidecarInbound

	env := newTestEnvironment(serviceDiscovery, testMesh, buildEnvoyFilterConfigStore(configPatches))
	push := model.NewPushContext()
	push.InitContext(env, nil, nil)

	for _, c := range testCases {
		t.Run(c.name, func(t *testing.T) {
			gotConfigs := InsertedExtensionConfigurations(push.EnvoyFilters(&model.Proxy{Type: model.SidecarProxy, ConfigNamespace: "not-default"}),
				c.requestedNames)

          WORKDIR /minio
          ENV GOEXPERIMENT=boringcrypto
          RUN make
          EOF

      - name: Build
        uses: docker/build-push-action@v3
        with:
          context: .
          file: Dockerfile.fips.test
          push: false
          load: true
          tags: minio/fips-test:latest

      # This should fail if grep returns non-zero exit
      - name: Test binary
        run: |

					}

					if conflictWithReservedListener(node, push, bind.Primary(), servicePort.Port, servicePort.Protocol) {
						log.Debugf("buildSidecarOutboundListeners: skipping service port %s:%d for node %s as it conflicts with static listener",
							service.Hostname, servicePort.Port, node.ID)
						continue
					}

					listenerOpts := outboundListenerOpts{
						push:    push,
						proxy:   node,
						bind:    bind,