feat: add goqueryguard linter

[mario-pinderi]

goqueryguard detects database queries executed inside loops (including indirect call chains), helping catch N+1 query patterns and similar performance issues early in CI.
https://github.com/mario-pinderi/goqueryguard

[CLAassistant]

All committers have signed the CLA.

[boring-cyborg]

Hey, thank you for opening your first Pull Request !

[leonklingele]

Hey @mario-pinderi 😊 How does your linter compare against unqueryvet which also includes a N+1 query detection and already is part of golangci-lint?

[mario-pinderi]

Hi @leonklingele 👋 This goes deeper regarding queries in loops. Two main differences:

1. It flags not just direct db.Query... in loops, but also indirect calls (loop -> service -> repo -> db).
2. It resolves interface-dispatched paths (CHA+VTA), so it can still catch loop-triggered DB calls hidden behind interfaces.

[ldez]

In order for a pull request adding a linter to be reviewed, the linter and the PR must follow some requirements.

• The CLA must be signed

Pull Request Description

• It must have a link to the linter repository.
• It must provide a short description of the linter.

Base Requirements

These requirements are not declarative; the team will verify them.

• It must not be a duplicate of another linter or a rule of a linter.
• It must not have false positives/negatives.

Linter

• It must have a valid license:
  • AGPL is not allowed
  • The file must start with LICENSE (capitalized)
  • The file must contain the required information by the license, ex: author, year, etc.
• It must use Go version <= 1.25.0
• The linter repository must have a CI and tests.
• It must use go/analysis.
• It must have a valid semver tag, ex: v1.0.0, v0.1.0 (0.0.x are not valid).
• It must not contain:
  • init()
  • panic()
  • log.Fatal(), os.Exit(), or similar.
• It must not modify the AST.
• It must have tests inside golangci-lint.

The Linter Tests Inside Golangci-lint

• They must have at least one std lib import.
• They must have integration tests without configuration (default).
• They must have integration tests with configuration (if the linter has a configuration).

.golangci.next.reference.yml

• The file .golangci.next.reference.yml must be updated.
• The file .golangci.reference.yml must NOT be edited.
• The linter must be added to the lists of available linters (alphabetical case-insensitive order).
  • enable and disable options
• If the linter has a configuration, the exhaustive configuration of the linter must be added (alphabetical case-insensitive order)
  • The values must be different from the default ones.
  • The default values must be defined in a comment.
  • The option must have a short description.

Other Requirements

• The files (tests and linter) inside golangci-lint must have the same name as the linter.
• The .golangci.yml of golangci-lint itself must not be edited, and the linter must not be added to this file.
• The linters must be sorted in alphabetical order (case-insensitive) in the lintersdb/builder_linter.go and .golangci.next.reference.yml.
• The load mode (WithLoadMode(...)):
  • if the linter uses goanalysis.LoadModeSyntax -> no WithLoadForGoAnalysis() in lintersdb/builder_linter.go
  • if the linter uses goanalysis.LoadModeTypesInfo, it requires WithLoadForGoAnalysis() in lintersdb/builder_linter.go
• The version in WithSince(...) must be the next minor version (v2.X.0) of golangci-lint.
• WithURL() must contain the URL of the repository.

Recommendations

• The file jsonschema/golangci.next.jsonschema.json should be updated.
• The file jsonschema/golangci.jsonschema.json must NOT be edited.
• The linter repository should have a readme and linting.
• The linter should be published as a binary (useful for diagnosing bug origins).
• The linter repository should have a .gitignore (IDE files, binaries, OS files, etc. should not be committed)
• Use main as the default branch name.

Workflow

• A tag should never be recreated.
• The reviews or changes should be addressed as commits (no squash).

---

The golangci-lint team will edit this comment to check the boxes before and during the review.

The code review will start after the completion of those checkboxes (except for the specific items that the team will help to verify).

If the author of the PR is a member of the golangci-lint team, he should not edit this message.

This checklist does not imply that we will accept the linter.

[ldez]

This can be an improvement of unqueryvet, and a file as configuration is not how we handle things inside golangci-lint.