From 2442896a3a672663e45b6f700f3dda7ef83f93cf Mon Sep 17 00:00:00 2001
From: "service-bot-app[bot]" <service-bot-app[bot]@users.noreply.github.com>
Date: Fri, 19 Sep 2025 03:14:15 +0000
Subject: [PATCH] chore: update repo semaphore config

---
 .semaphore/semaphore.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index 66062286..e14f3a5b 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -32,14 +32,20 @@ blocks:
     dependencies: []
     run:
       # don't run the tests on non-functional changes...
-      when: "change_in('/', {exclude: ['/.deployed-versions/', '.github/']})"
+      when: "change_in('/', {exclude: ['/.deployed-versions/', '.github/'], default_branch: 'master'})"
     task:
       jobs:
         - name: Test
           commands:
             - . sem-pint
             - mvn -Dcloud -Pjenkins -U -Dmaven.wagon.http.retryHandler.count=10 --batch-mode --no-transfer-progress clean verify install dependency:analyze validate
-            - cve-scan
+            - export TRIVY_DISABLE_VEX_NOTICE=true
+            - trivy version
+            - echo "Check go/connector-dev-vuln-remediation for fixing or suppressing vulnerabilities found by trivy"
+            - trivy --skip-files "*.zip" rootfs --scanners vuln --db-repository public.ecr.aws/aquasecurity/trivy-db --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db --ignore-unfixed 
+              --ignorefile .trivyignore --exit-code 1 --severity CRITICAL target/components/packages
+            - trivy --skip-files "*.zip" rootfs --scanners vuln --db-repository public.ecr.aws/aquasecurity/trivy-db --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db --ignore-unfixed 
+              --ignorefile .trivyignore --severity HIGH,LOW,MEDIUM target/components/packages
             - . cache-maven store
       epilogue:
         always:
@@ -56,14 +62,15 @@ blocks:
       jobs:
         - name: Release
           commands:
-            - mvn -Dcloud -Pjenkins -U -Dmaven.wagon.http.retryHandler.count=10 --batch-mode -DaltDeploymentRepository=confluent-codeartifact-internal::default::https://confluent-519856050701.d.codeartifact.us-west-2.amazonaws.com/maven/maven-snapshots/
+            - mvn -Dcloud -Pjenkins -U -Dmaven.wagon.http.retryHandler.count=10 --batch-mode 
+              -DaltDeploymentRepository=confluent-codeartifact-internal::default::https://confluent-519856050701.d.codeartifact.us-west-2.amazonaws.com/maven/maven-snapshots/ 
               -DrepositoryId=confluent-codeartifact-internal deploy -DskipTests
 
 after_pipeline:
   task:
     agent:
       machine:
-        type: s1-prod-ubuntu24-04-arm64-0
+        type: s1-prod-ubuntu24-04-arm64-00
     jobs:
       - name: Metrics
         commands: