} else {
            buildFile << """
                pmd {
                    toolVersion = '$version'
                    ruleSetConfig = resources.text.fromString('''<?xml version="1.0"?>
                        <ruleset name="Unused Code">
                            <description>Copy of https://github.com/pmd/pmd/blob/master/pmd-java/src/main/resources/rulesets/java/unusedcode.xml without deprecations.</description>

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    action: DENY
    policies:
      ns[foo]-policy[httpbin-deny]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - orIds:
                ids:
                - authenticated:

  shadowRules:
    action: DENY
    policies:
      ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /deny
        principals:
        - andIds:
            ids:
            - any: true

			},
			false,
		},
	}
	builderConfig := &config.Config{
		EnableIPv6: true,
	}
	checkFunc := func(goldenName string, rules [][]string, rulesRestore string, expected bool) {
		// check that rules are set
		if expected {
			var actual strings.Builder
			for _, rule := range rules {
				fmt.Fprintln(&actual, strings.Join(rule, " "))
			}
			compareToGolden(t, goldenName, actual.String())

spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
  rules:
  - backendRefs:
    - name: httpbin
      port: 443
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata:
  name: tls-match
  namespace: default
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
  hostnames:
  - "foo.com"
  rules:
  - backendRefs:
    - name: httpbin-foo
      port: 443
---

		inpodMarkRule.Family = family
		inpodMarkRule.Table = RouteTableInbound
		inpodMarkRule.Mark = InpodTProxyMark
		inpodMarkRule.Mask = InpodTProxyMask
		inpodMarkRule.Priority = 32764
		rules = append(rules, inpodMarkRule)
	}

	for _, rule := range rules {
		log.Debugf("Iterating netlink rule : %+v", rule)
		if err := f(rule); err != nil {
			return fmt.Errorf("failed to configure netlink rule: %w", err)
		}
	}

	return nil
}

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole
  // +optional
  repeated PolicyRule rules = 2;

  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
  // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
  // stomped by the controller.
  // +optional

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    action: LOG
    policies:
      ns[foo]-policy[audit-all]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - any: true

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    action: DENY
    policies:
      ns[foo]-policy[deny-all]-rule[0]:
        permissions:
        - andRules:
            rules:
            - any: true
        principals:
        - andIds:
            ids:
            - any: true

            "-Darchunit.freeze.refreeze=${refreezeBoolean}",
            "-Darchunit.freeze.store.default.allowStoreUpdate=${refreezeBoolean}"
        )
    }
}

/**
 * Sorts the stored rules, so we keep a deterministic order when we add new rules.
 */
abstract class ReorderArchUnitRulesTask : DefaultTask() {
    @get:OutputFile
    abstract var ruleFile: File

    @TaskAction
    fun resortStoredRules() {