Static Analysis

Dependencies

• GNU Make
• copywrite
• golangci-lint
• govulncheck
• uv
• SQLFluff

Install development utilities

Install the Go linter, the vulnerability scanner, and the license checker:

$ make dev-install-tools

Install SQLFluff:

$ make dev-install-sqlfluff

This uses uv to create a virtual environment under internal/repository/.venv/. The files internal/repository/pyproject.toml and internal/repository/uv.lock set the exact package versions.

Run linters

Go

Check Go sources with golangci-lint:

$ make lint

Check Go source headers with copywrite:

$ make copywrite

Check Go sources and go.mod for vulnerabilities:

$ make vulncheck

SQL Migrations

Check SQL files with SQLFluff:

$ make lint-sql

Format SQL files with SQLFluff:

$ make format-sql

Applied migrations must keep their statements unchanged. A newer SQLFluff release can add a rule that an applied migration no longer passes. In this case, add a -- noqa: <RULE> comment on the failing line. Do not change the statement. New migrations must pass the current rule set.