} else {
                            // We should never come across a situation where an assignment already exists that is in a higher generation,
                            // but if we do, just pull the emergency stop handle as this is indicative of a bug rather than a user error.
                            error("Unexpected assignment in higher generation")
                        }
                    }

name: Java CI

on: [push, pull_request, workflow_dispatch]

# clear all permissions for GITHUB_TOKEN
permissions: {}

jobs:
  build:

    # execute on any push, workflow_dispatch  or pull request from forked repo
    if: >
      github.event_name == 'push' ||
      github.event_name == 'workflow_dispatch' ||
      ( github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork )

			}
			result = append(result, ec)
		}
	}
	return result
}

func updatePluginConfig(pluginConfig *wasmextensions.PluginConfig, pullSecrets map[string][]byte) {
	// Find the pull secret resource name from wasm vm env variables.
	// The Wasm extension config should already have a `ISTIO_META_WASM_IMAGE_PULL_SECRET` env variable

func TestGatewayConformance(t *testing.T) {
	framework.
		NewTest(t).
		Run(func(ctx framework.TestContext) {
			crd.DeployGatewayAPIOrSkip(ctx)

			// Precreate the GatewayConformance namespaces, and apply the Image Pull Secret to them.
			if ctx.Settings().Image.PullSecret != "" {
				for _, ns := range conformanceNamespaces {
					namespace.Claim(ctx, namespace.Config{
						Prefix: ns,
						Inject: false,
					})
				}
			}

	// They are added automatically, and should not be alerted on.
	// Delete these related annotations once they are stable.
	// Ref: https://github.com/istio/api/pull/2695
	constants.AmbientWaypointForTrafficTypeLabel: true,
	constants.AmbientRedirection:                 true,
}

// Analyze implements analysis.Analyzer
func (fa *AlphaAnalyzer) Analyze(ctx analysis.Context) {

	// nolint: revive, stylecheck
	TAG Variable = "TAG"

	// VARIANT is the Docker variant to be used for images.
	// nolint: revive, stylecheck
	VARIANT Variable = "VARIANT"

	// PULL_POLICY is the image pull policy to use when rendering templates.
	// nolint: revive, stylecheck
	PULL_POLICY Variable = "PULL_POLICY"

	// ECHO_IMAGE is the image to use when deploying echo services.
	// nolint: golint, revive, stylecheck

	Proxy Proxy

	// CertificatesDir specifies where to store or look for all required certificates.
	CertificatesDir string

	// ImageRepository sets the container registry to pull images from.
	// If empty, `registry.k8s.io` will be used by default; in case of kubernetes version is a CI build (kubernetes version starts with `ci/`)

    # Default tag for Istio images.
    tag: latest

    # Variant of the image to use.
    # Currently supported are: [debug, distroless]
    variant: ""

    # Specify image pull policy if default behavior isn't desired.
    # Default behavior: latest images will be Always else IfNotPresent.
    imagePullPolicy: ""

    # change cni scope level to control logging out of istio-cni-node DaemonSet

// AddImageMetaFlags adds the --image-repository flag to the given flagset
func AddImageMetaFlags(fs *pflag.FlagSet, imageRepository *string) {
	fs.StringVar(imageRepository, ImageRepository, *imageRepository, "Choose a container registry to pull control plane images from")
}

// AddFeatureGatesStringFlag adds the --feature-gates flag to the given flagset
func AddFeatureGatesStringFlag(fs *pflag.FlagSet, featureGatesString *string) {

		statLocal: func(rev, remote string) []string {
			return []string{"hg", "log", "-l1", "-r", rev, "--template", "{node} {date|hgdate} {tags}"}
		},
		parseStat: hgParseStat,
		fetch:     []string{"hg", "pull", "-f"},
		latest:    "tip",
		readFile: func(rev, file, remote string) []string {
			return []string{"hg", "cat", "-r", rev, file}
		},
		readZip: func(rev, subdir, remote, target string) []string {