if: ${{ github.event_name == 'push' }}
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Build binary and run python tests on nightly for all python versions
        shell: bash
        run: |
          is_nightly=0 && tf_project_name='tf_ci_ext' && ${{ github.event_name == 'schedule' }} && is_nightly=1 && tf_project_name='tf_nightly_ci_ext'

# any.sh has two run modes.
#
# 1. RUN, TEST, OR BUILD BAZEL TARGET(S) WITHIN A TFCI ENVIRONMENT
#    To use:
#       export TFCI=ci/official/envs/env_goes_here
#       export TF_ANY_TARGETS="quoted list of targets, like on the command line"
#       export TF_ANY_MODE="test" or "build" or "run" (default: "test")
#       ./any.sh
#
# 2. RUN ANY OTHER SCRIPT AND ENV WITH NO SIDE EFFECTS (NO UPLOADS)

 * might run on the {@code directExecutor()} or be otherwise re-entrant (call back into your
 * object). So it is important to not call {@link #dispatch} while holding any locks. This is why
 * {@link #enqueue} and {@link #dispatch} are 2 different methods. It is expected that the decision
 * to run a particular event is made during the state change, but the decision to actually invoke

    enum ExecutionMode {
        /**
         * Run at the beginning of each build. Kill potentially leaked processes in previous builds.
         * Only kill local Gradle processes (classpath in checkout directory).
         * Not clean up global Gradle processes (i.e. classpath in ~/.gradle/...).
         */
        KILL_LEAKED_PROCESSES_FROM_PREVIOUS_BUILDS,
        /**

		;;
	"wasmer")
		exec wasmer run --dir=/ --env PWD="$PWD" --env PATH="$PATH" ${GOWASIRUNTIMEARGS:-} "$1" -- "${@:2}"
		;;
	"wazero")
		exec wazero run -mount /:/ -env-inherit -cachedir "${TMPDIR:-/tmp}"/wazero ${GOWASIRUNTIMEARGS:-} "$1" "${@:2}"
		;;
	"wasmtime" | "")
		exec wasmtime run --dir=/ --env PWD="$PWD" --env PATH="$PATH" -W max-wasm-stack=1048576 ${GOWASIRUNTIMEARGS:-} "$1" "${@:2}"

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: 1.22.7
      - name: Get official govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest
        shell: bash
      - name: Run govulncheck
        run: govulncheck -show verbose ./...

=== ":material-language-kotlin: Kotlin"
    ```kotlin
      private val client = OkHttpClient()

      fun run() {
        val request = Request.Builder()
            .url("https://publicobject.com/helloworld.txt")
            .build()

        client.newCall(request).execute().use { response ->

    @Override
    protected void startUp() {
      startUpCalled = true;
      throw new UnsupportedOperationException("kaboom!");
    }

    @Override
    protected void run() {
      throw new AssertionError("run() should not be called");
    }

    @Override
    protected Executor executor() {
      return exceptionCatchingExecutor;
    }
  }

    if (!compareAndSet(null, currentThread)) {
      return; // someone else has run or is running.
    }

    boolean run = !isDone();
    T result = null;
    Throwable error = null;
    try {
      if (run) {
        result = runInterruptibly();
      }
    } catch (Throwable t) {
      restoreInterruptIfIsInterruptedException(t);
      error = t;
    } finally {

        enable-cache: true
        cache-dependency-glob: |
            requirements**.txt
            pyproject.toml
    - name: Install GitHub Actions dependencies
      run: uv pip install -r requirements-github-actions.txt
    - name: Label Approved
      run: python ./scripts/label_approved.py
      env:
        TOKEN: ${{ secrets.GITHUB_TOKEN }}
        CONFIG: >
          {
            "approved-1":
              {