actions: read  # for github/codeql-action/init to get workflow details
      contents: read  # for actions/checkout to fetch code
      security-events: write  # for github/codeql-action/analyze to upload SARIF results
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        # Override automatic language detection by changing the below list

    # Only shows Added, Changed, Modified, Renamed, and Type-changed files
    if [[ "$(git rev-parse --abbrev-ref HEAD)" == "pull_branch" ]]; then
        # TF's CI runs 'git fetch origin "pull/PR#/merge:pull_branch"'
        # To get the as-merged branch during the CI tests
        git diff --diff-filter ACMRT --name-only pull_branch^ pull_branch > $BATS_FILE_TMPDIR/changed_files
    else

```mermaid
flowchart TD
    CNIP["CNI Plugin"]
    CNI["CNI Agent"]
    Z["Ztunnel"]
    Pods["Pods"]
    CNI --Programs--> Z
    CNI --Watches--> Pods
    Z --Runs Within--> Pods
    CNIP --Calls--> CNI
```

The CNI Plugin is a binary installed as a [CNI plugin](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) on the node.

import java.util.Set;
import javax.annotation.CheckForNull;
import junit.framework.Assert;
import junit.framework.AssertionFailedError;
import org.checkerframework.checker.nullness.qual.Nullable;

/**
 * Tester that runs automated sanity tests for any given class. A typical use case is to test static
 * factory classes like:
 *
 * <pre>
 * interface Book {...}
 * public class Books {
 *   public static Book hardcover(String title) {...}

 *
 * @author Ben Yu
 */
public class AbstractPackageSanityTestsTest extends TestCase {
  /*
   * This is a public type so that the Android test runner can create an instance directly as it
   * insists upon doing. It then runs the test, which behaves exactly like this package's existing
   * PackageSanityTests. (The test would run on the JVM, too, if not for the suppression below, and

 */
fun buildTestEngine(): TestEngine = JupiterTestEngine()

/**
 * Returns a fixed set of test classes from testlist.txt, skipping any not found in the
 * current classpath.  The IDE runs with less classes to avoid conflicting module ownership.
 */
fun testSelectors(inputFile: File? = null): List<DiscoverySelector> {
  val sampleTestClass = SampleTest::class.java

  val lines =

  @Param boolean noWorkToDo;

  Random random;
  String testString;

  @BeforeExperiment
  void setUp() {
    random = new Random(0xdeadbeef); // fix the seed so results are comparable across runs

    int nonAlpha = size / nonAlphaRatio;
    int alpha = size - nonAlpha;

    List<Character> chars = Lists.newArrayListWithCapacity(size);
    for (int i = 0; i < alpha; i++) {
      chars.add(randomAlpha());

			t.Fatalf("FAIL: Temporary file not cleaned in %v: %v", tempCNIConfDir, f.Name())
		}
	}
	t.Logf("PASS: All temporary files removed from %v", tempCNIConfDir)
}

// doTest sets up necessary environment variables, runs the Docker installation
// container and verifies output file correctness.
func doTest(t *testing.T, chainedCNIPlugin bool, wd, preConfFile, resultFileName, delayedConfFile, expectedOutputFile,

 *
 * @author Ben Yu
 */
public class AbstractPackageSanityTestsTest extends TestCase {
  /*
   * This is a public type so that the Android test runner can create an instance directly as it
   * insists upon doing. It then runs the test, which behaves exactly like this package's existing
   * PackageSanityTests. (The test would run on the JVM, too, if not for the suppression below, and

    assertThrows(CancellationException.class, () -> resultFuture.get());
  }

  public void testFutureCancellableBeforeFunctionCompletion() throws Exception {
    // Set the result in a separate thread since this test runs the function
    // (which will block) in the same thread.
    new Thread() {
      @Override
      public void run() {
        inputFuture.set(SLOW_FUNC_VALID_INPUT_DATA);
      }
    }.start();