feat: add semgrep to makefile & fix it's rules

.github/workflows/secure.yml

@@ -21,7 +21,7 @@ jobs:
       security-events: write
     steps:
       - uses: actions/checkout@v4
-      - run: semgrep scan --sarif --output=semgrep.sarif --error --severity=WARNING
+      - run: semgrep scan --sarif --output=semgrep.sarif --error --severity=WARNING --severity=ERROR
         env:
           SEMGREP_RULES: >-
             p/command-injection

.semgrepignore

@@ -1 +1,2 @@
 website/
+*_test.go

GNUmakefile

@@ -45,4 +45,27 @@ ifeq (,$(wildcard $(GOPATH)/src/$(WEBSITE_REPO)))
 endif
 	@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider-test PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
 
-.PHONY: golangci-lint build test testacc fmt test-compile website website-test
+
+# CLI reference:
+# https://semgrep.dev/docs/cli-reference
+semgrep:
+	docker run --rm -v ${PWD}:/app:ro -w /app semgrep/semgrep semgrep scan --error --metrics=off \
+		--config=p/command-injection \
+		--config=p/comment \
+		--config=p/cwe-top-25 \
+		--config=p/default \
+		--config=p/gitleaks \
+		--config=p/golang \
+		--config=p/gosec \
+		--config=p/insecure-transport \
+		--config=p/owasp-top-ten \
+		--config=p/r2c-best-practices \
+		--config=p/r2c-bug-scan \
+		--config=p/r2c-security-audit \
+		--config=p/secrets \
+		--config=p/security-audit \
+		--config=p/sql-injection \
+		--config=p/xss \
+		.
+
+.PHONY: golangci-lint build test testacc fmt test-compile semgrep website website-test

selectel/dbaas.go

@@ -1,7 +1,6 @@
 package selectel
 
-//nolint:gci
-import ( // nosemgrep: gitlab.gosec.G501-1
+import (
 	"context"
 	"crypto/md5"
 	"errors"