on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

concurrency:
  # On master/release, we don't want any jobs cancelled so the sha is used to name the group
  group: ${{ (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/release' ) && format('contributor-pr-base-{0}', github.sha) || format('contributor-pr-{0}', github.ref) }}
  cancel-in-progress: false

env:

        with:
          distribution: 'zulu'
          java-version: 17

      - name: Enable KVM group perms
        # https://github.blog/changelog/2023-02-23-hardware-accelerated-android-virtualization-on-actions-windows-and-linux-larger-hosted-runners/
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules

func checkKMSActionAllowed(r *http.Request, owner bool, cred auth.Credentials, action policy.KMSAction, resource string) bool {
	return globalIAMSys.IsAllowed(policy.Args{
		AccountName:     cred.AccessKey,
		Groups:          cred.Groups,
		Action:          policy.Action(action),
		ConditionValues: getConditionValues(r, "", cred),
		IsOwner:         owner,
		Claims:          cred.Claims,

                if (matcher.matches()) {
                    Snapshot snapshot = new Snapshot();
                    snapshot.setTimestamp(matcher.group(2));
                    try {
                        snapshot.setBuildNumber(Integer.parseInt(matcher.group(3)));
                        artifact.addMetadata(new SnapshotArtifactRepositoryMetadata(artifact, snapshot));
                    } catch (NumberFormatException e) {

name: Root lockdown tests

on:
  pull_request:
    branches:
      - master

# This ensures that previous jobs for the PR are canceled when the PR is
# updated.
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build:
    name: Go ${{ matrix.go-version }} on ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:

  <modelVersion>4.0.0</modelVersion>
  <groupId>com.example.group</groupId>
  <artifactId>testinvalidpom</artifactId>
  <version>0.0.1-SNAPSHOT</version>

  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>the.groupId.Of.This.Plugin</groupId>
          <artifactId/>
        </plugin>
      </plugins>
    </pluginManagement>
  </build>

  <modelVersion>4.0.0</modelVersion>
  <groupId>com.example.group</groupId>
  <artifactId>testinvalidpom</artifactId>
  <version>0.0.1-SNAPSHOT</version>

  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId></groupId>
          <artifactId/>
        </plugin>
      </plugins>
    </pluginManagement>
  </build>

  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.example.group</groupId>
  <artifactId>valid-version-changelist</artifactId>
  <version>${changelist}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.

      var pkcs8Base64: String? = null
      for (match in PEM_REGEX.findAll(certificateAndPrivateKeyPem)) {
        when (val label = match.groups[1]!!.value) {
          "CERTIFICATE" -> {
            require(certificatePem == null) { "string includes multiple certificates" }
            certificatePem = match.groups[0]!!.value // Keep --BEGIN-- and --END-- for certificates.
          }
          "PRIVATE KEY" -> {

    util.concurrent tests under Guava.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see
    https://groups.google.com/g/google-web-toolkit-contributors/c/CqYH59Dt_rQ/m/uVGW1QdUsXUJ
    for details.

    The summary is that it ignores one file in favor of the other.