Add semgrep, py3-semgrep and dependencies

[goproslowyo]

First pass at building semgrep, pysemgrep and all the dependencies.

wolfictl scan:

semgrep-cli dependency graph:

Dependencies:

• py3-attrs
• py3-boltons
• py3-bracex
• py3-click-option-group
• py3-defusedxml
• py3-face
• py3-glom
• py3-idna
• py3-jsonschema
• py3-jsonschema-specifications
• py3-markdown-it-py
• py3-mdurl
• py3-peewee
• py3-python-lsp-jsonrpc
• py3-referencing
• py3-requests
• py3-rich
• py3-rpds
• py3-ruamel.yaml
• py3-ruamel.yaml.clib
• py3-ujson
• py3-wcmatch

Fixes:
Fixes #797
#797

Related:

Pre-review Checklist

For new package PRs only

• This PR is marked as fixing a pre-existing package request bug
  • Alternatively, the PR is marked as related to a pre-existing package request bug, such as a dependency
• REQUIRED - The package is available under an OSI-approved or FSF-approved license
• REQUIRED - The version of the package is still receiving security updates

[goproslowyo]

Hmmm, I think wolfictl might have a bug around here (or maybe when it trims the suffix?) if the filename is like py3-ruamel.yaml.yaml.

I noticed during this CI failure. This basically causes the wrong filename (py3-ruamel.yaml instead of py3-ruamel.yaml.yaml) to get passed into os.ReadFile.

Here's a simple PoC: https://go.dev/play/p/yAUSuMaR6TQ

I opened an issue in the repo over here wolfi-dev/wolfictl#332.

[goproslowyo]

Thanks @imjasonh! I also noticed a few packages I previously added are now in the repository and seemed auto-generated based the comments: 4e4265b

Should I be replacing the other packages I wrote w/ autogenerated ones from melange generate python?

And one last question, the CI is still failing on the bad version for py3-bracex: error during command execution: 1 error occurred:\n\t* failed to create a version slice for facelessuser/bracex: failed to create a version from 2.3.post1: Malformed version: 2.3.post1 -- I haven't seen any patterns on how this is worked around just yet... EDIT: I saw tag-filter but wasn't sure how it was applied -- will look at melange code in a bit. strip-prefix was the answer it seems.

[goproslowyo]

Hey @imjasonh -- just checking in re: my question above. FYI, I occasionally re-base the PR against main to keep it up-to-date if it's ready to merge.

[ajayk]

Hey @imjasonh -- just checking in re: my question above. FYI, I occasionally re-base the PR against main to keep it up-to-date if it's ready to merge.

@goproslowyo these packages should be fine , Thanks for your contribution !!!