CI: Update semgrep rules & config (#2739)

* CI: Update semgrep rules & config

* e2e tests: Fix leaky timer (#2745)
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

.circleci/config.yml

@@ -508,18 +508,19 @@ jobs:
       SEMGREP_BASELINE_REF: << parameters.diff_branch >>
       SEMGREP_REPO_URL: << pipeline.project.git_url >>
       SEMGREP_BRANCH: << pipeline.git.branch >>
+      SEMGREP_COMMIT: << pipeline.git.revision >>
 
       # Change job timeout (default is 1800 seconds; set to 0 to disable)
       SEMGREP_TIMEOUT: 3000
 
     docker:
       - image: returntocorp/semgrep
+    resource_class: xlarge
     steps:
       - checkout
       - run:
           name: "Set environment variables" # for PR comments and in-app hyperlinks to findings
           command: |
-              echo 'export SEMGREP_COMMIT=$CIRCLE_SHA1' >> $BASH_ENV
               echo 'export SEMGREP_PR_ID=${CIRCLE_PULL_REQUEST##*/}' >> $BASH_ENV
               echo 'export SEMGREP_JOB_URL=$CIRCLE_BUILD_URL' >> $BASH_ENV
               echo 'export SEMGREP_REPO_NAME=$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME' >> $BASH_ENV

.semgrepignore

@@ -20,4 +20,4 @@ tests/
 
 l2geth/
 packages/*/node_modules
-packages/*/test
\ No newline at end of file
+packages/*/test

Makefile

@@ -77,6 +77,12 @@ test-integration:
 		./packages/contracts-bedrock/deployments/devnetL1
 .PHONY: test-integration
 
+# Remove the baseline-commit to generate a base reading & show all issues
+semgrep:
+	$(eval DEV_REF := $(shell git rev-parse develop))
+	SEMGREP_REPO_NAME=ethereum-optimism/optimism semgrep ci --baseline-commit=$(DEV_REF)
+.PHONY: semgrep
+
 devnet-genesis:
 	bash ./ops-bedrock/devnet-genesis.sh
 .PHONY: devnet-genesis

op-e2e/system_test.go

@@ -170,6 +170,8 @@ func TestL2OutputSubmitter(t *testing.T) {
 
 	// Wait for batch submitter to update L2 output oracle.
 	timeoutCh := time.After(15 * time.Second)
+	ticker := time.NewTicker(1 * time.Second)
+	defer ticker.Stop()
 	for {
 		l2ooTimestamp, err := l2OutputOracle.LatestBlockTimestamp(&bind.CallOpts{})
 		require.Nil(t, err)
@@ -205,7 +207,7 @@ func TestL2OutputSubmitter(t *testing.T) {
 		select {
 		case <-timeoutCh:
 			t.Fatalf("State root oracle not updated")
-		case <-time.After(time.Second):
+		case <-ticker.C:
 		}
 	}