persist-credentials: false

      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          java-version: ${{ matrix.java }}
          distribution: 'temurin'
#          cache: 'maven' - don't use cache for integration tests

      - uses: actions/checkout@v4
        with:
          path: maven/
          persist-credentials: false

   * "permits / time", thus "1 / rate = time / permits". Thus, "1/rate" (time / permits) times
   * "permits" gives time, i.e., integrals on this function (which is what storedPermitsToWaitTime()
   * computes) correspond to minimum intervals between subsequent requests, for the specified number
   * of requested permits.
   *

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
 - |
   **Added** `PILOT_ENABLE_K8S_SELECT_WORKLOAD_ENTRIES` feature back to Istio which was removed in 1.14.

        for range s {}
        for i = range s {}
        for i, j /* ERRORx `range over .* permits only one iteration variable` */ = range s {}
        for i, j, k /* ERRORx `range over .* permits only one iteration variable|at most 2 expressions` */ = range s {}
        for i, j, k, l /* ERRORx `range over .* permits only one iteration variable|at most 2 expressions` */ = range s {}

   * "permits / time", thus "1 / rate = time / permits". Thus, "1/rate" (time / permits) times
   * "permits" gives time, i.e., integrals on this function (which is what storedPermitsToWaitTime()
   * computes) correspond to minimum intervals between subsequent requests, for the specified number
   * of requested permits.
   *

            runnable.run();
        }
    }

    @Override
    public Permits getPluginsBlockPermits() {
        VersionCatalogsExtension versionCatalogs = target.getExtensions().findByType(VersionCatalogsExtension.class);
        if (versionCatalogs != null) {
            return new Permits(versionCatalogs.getCatalogNames());
        }
        return Permits.none();
    }

// include is the list of resources that the expression-based admission controllers
// should intercept.
// The version is omitted, all versions of the same GroupResource are treated the same.
// If a resource is transient, i.e., not persisted in the storage, the resource must be
// in either include or excluded list.
var included = []schema.GroupResource{
	{Group: "", Resource: "bindings"},
	{Group: "", Resource: "pods/attach"},

      regardless of whether or not it was the most specific host match. Now, the most specific host match will take precedence. To persist the old behavior,

     * @param deferrable true when the action can be deferred
     */
    void addConfiguration(Runnable runnable, boolean deferrable);

    default Permits getPluginsBlockPermits() {
        return Permits.none();
    }

        this.caches = caches;
        this.inMemoryCaches = inMemoryCaches;
    }

    /**
     * Returns caches which will also be persisted to disk. They will also have an in-memory
     * front-end, but eventually all results are persisted.
     */
    public ModuleRepositoryCaches getPersistentCaches() {
        return caches;
    }

    /**