then:
        executer.expectDocumentedDeprecationWarning("Declaring client module dependencies has been deprecated. This is scheduled to be removed in Gradle 9.0. Please use component metadata rules instead. Consult the upgrading guide for further information: https://docs.gradle.org/current/userguide/upgrading_version_8.html#declaring_client_module_dependencies")
        succeeds('listJars')

        when:

    /**
     * Returns a matcher that uses the consumer rules from this schema, and the producer rules from the given schema.
     */
    AttributeMatcher withProducer(AttributesSchemaInternal producerSchema);

    /**
     * Returns a matcher that uses the rules from this schema, and assumes the producer has the same rules.
     */
    AttributeMatcher matcher();

  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Rules holds all the PolicyRules for this ClusterRole
  // +optional
  repeated PolicyRule rules = 2;

  // AggregationRule is an optional field that describes how to build the Rules for this ClusterRole.
  // If AggregationRule is set, then the Rules are controller managed and direct changes to Rules will be
  // stomped by the controller.
  // +optional

name: envoy.filters.http.rbac
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC
  rules:
    policies:
      ns[foo]-policy[httpbin-1]-rule[0]:
        permissions:
        - andRules:
            rules:
            - orRules:
                rules:
                - header:
                    name: :authority
                    stringMatch:
                      exact: exact.com

            # And skip validation of publishing rules for it
            continue

        for item in rule["branches"]:
            if "dir" in item["source"]:
                raise Exception("use of deprecated `dir` field in rules for `%s`" % (rule["destination"]))
            if len(item["source"]["dirs"]) > 1:

metadata:
  name: httpbin # This is a correct scenario
  namespace: httpbin
spec:
  selector: # There are workloads matching this selector
    matchLabels:
      app: httpbin
      version: v1
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/default/sa/sleep"]
        - source:
            namespaces: ["httpbin"] # Namespace exists
      to:
        - operation:

	clusterRole := sharedClusterRole.DeepCopy()
	clusterRole.Rules = nil
	for _, rule := range newPolicyRules {
		clusterRole.Rules = append(clusterRole.Rules, *rule.DeepCopy())
	}
	_, err := c.clusterRoleClient.ClusterRoles().Update(ctx, clusterRole, metav1.UpdateOptions{})
	return err
}

func toApplyPolicyRules(rules []rbacv1.PolicyRule) []*rbacv1ac.PolicyRuleApplyConfiguration {

     * Attempts to bind the references of all model rules known at this point in time.
     * <p>
     * This method effectively validates that all references bind (i.e. all rules are executable).
     * It should be called when the model registry is at some kind of logical checkpoint, in that it is reasonable
     * to expect that all rules have been discovered.
     * <p>
     * However, it does not prevent rules from being added after being called.

 * <p>
 * Finalize rules execute after {@link Mutate} rules, but before {@link Validate} rules.
 * The first parameter of the rule is the rule subject, which is mutable for the duration of the rule.
 * <p>
 * Please see {@link RuleSource} for more information on method rules.
 */
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
@Incubating

val codenarcVersion = if (isAtLeastGroovy4) "3.1.0-groovy-4.0" else "3.1.0"

dependencies {
    rules("gradlebuild:code-quality-rules") {
        because("Provides rules defined in XML files")
    }
    codenarc("gradlebuild:code-quality-rules") {
        because("Provides the IntegrationTestFixturesRule implementation")
    }
    codenarc("org.codenarc:CodeNarc:$codenarcVersion")