$ show houqp/sqlvet
Sqlvet is a static analysis CLI tool for Go projects that scans raw SQL queries embedded in Go source code to detect potential runtime errors at build time. It uses Go's SSA (Static Single Assignment) representation and call graph analysis to trace SQL query strings through function calls, handling common patterns like string concatenation, functions returning query strings, and pass-through functions like sqlx.Rebind. Extracted queries are parsed with a PostgreSQL grammar (via pg_query_go) to validate syntax, table/column names against a schema, and detect unsafe dynamic SQL that could lead to injection. The tool supports custom SQL function matchers via TOML configuration, allowing users to extend analysis to their own wrapper libraries. The architecture is a single Go binary with modular packages for configuration, schema parsing, query extraction, and SQL validation, with comprehensive test coverage including integration tests using real Go packages.
The LLM identified 3 files worth highlighting for reuse:
Provides CompileNamedQuery, a self-contained utility that converts SQL named parameters (`:param`) to positional bind variables (`$1`, `?`, `@p1`) for different database dialects. Ported from the sqlx library, it handles edge cases like PostgreSQL `::` type casts, string literals, and escape sequences. This is a clean, isolated function that can be extracted and reused in any Go project needing to manipulate SQL query parameter styles.
Core SQL validation logic that parses a query string into a PostgreSQL AST using pg_query_go, then walks the tree to validate table names, column names, and column counts in INSERT statements. It handles SELECT, INSERT, UPDATE, DELETE, CTEs, JOINs, subqueries, and window functions. The validation can be run standalone via ValidateSqlQuery and ValidateSqlQueries functions, making it a reusable library for any Go application that needs to check SQL against a database schema.
A minimal, well-tested parser for 'sqlvet: ignore' annotations in Go source comments. It strips prefixes and whitespace, returning a structured annotation object. This pattern is cleanly isolated and could be adapted as a generic comment annotation parser for other static analysis tools.