@Variant
            Integer getVariantProp()
            void setVariantProp(Integer variant)
        }
        class Rules extends RuleSource {
            @ComponentType
            void register(TypeBuilder<SampleBinary> builder) {}
        }
        apply plugin: Rules
        """

        expect:
        fails "components"

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /another
        principals:
        - andIds:
            ids:

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-2]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - urlPath:
                    path:
                      exact: /another
        principals:
        - andIds:
            ids:

contain rules which are evaluated against each dependency of the package in
question.

Evaluation starts with the rules file closest to the package.  If that file
makes a determination to allow or forbid the import, evaluation is done.  If
the import does not match any rule, the next-closest rules file is consulted,
and so forth.  If the rules files are exhausted and no determination has been

			wantCountFailed:       true,
			wantAction:            &failJob,
		},
		"successful containers are skipped by the rules": {
			podFailurePolicy: &batch.PodFailurePolicy{
				Rules: []batch.PodFailurePolicyRule{
					{
						Action: batch.PodFailurePolicyActionFailJob,
						OnExitCodes: &batch.PodFailurePolicyOnExitCodesRequirement{

        outputContains "Build was configured to prefer settings component metadata rules over project rules but rule 'opaque inline rule' was added by build file 'build.gradle'"
    }

    def "can fail the build if rules from settings are preferred and project declares rules"() {
        withLoggingRuleInSettings()
        repository {
            'org:module:1.0'()
        }

			NotPrincipals: stringToMatch(op.NotPrincipals),
		}
		fromMatches = append(fromMatches, match)
	}

	rules := []*security.Rules{}
	if len(toMatches) > 0 {
		rules = append(rules, &security.Rules{Matches: toMatches})
	}
	if len(fromMatches) > 0 {
		rules = append(rules, &security.Rules{Matches: fromMatches})
	}
	for _, when := range rule.When {
		l4 := l4WhenAttributes.Contains(when.Key)

		rbac := &rbachttp.RBAC{Rules: getBadCustomDenyRules(rules)}
		return []*hcm.HttpFilter{
			{
				Name:       wellknown.HTTPRoleBasedAccessControl,
				ConfigType: &hcm.HttpFilter_TypedConfig{TypedConfig: protoconv.MessageToAny(rbac)},
			},
		}
	}
	// Add the RBAC filter in shadow mode so that it only evaluates the matching rules for CUSTOM action but not enforce it.

        file("rules.xml") << customRuleSet()

        expect:
        succeeds(":pmdMain")

        where:
        customRuleSetConfig << [
            'ruleSetConfig = resources.text.fromFile("rules.xml")',
            'ruleSetFiles = files("rules.xml")'
        ]
    }

    def "use default rules if custom rules are not configured"() {
        given:
        buildFile << """

        int i = 0
        def rules = modelNode.myNumbers.@rules[0]
        rules[i++] == 'NumberRules#defaultsRule(Numbers)'
        rules[i++] == 'NumberRules#mutateRule(Numbers)'
        rules[i++] == 'ClassHolder.InnerRules#mutateRule(Numbers)'
        rules[i++] == 'NumberRules#finalizeRule(Numbers)'
        rules[i] == 'NumberRules#validateRule(Numbers)'
    }