feat(linter): expand linter from 10 to 30 rules — safety, performance, naming (#445)

* docs: add Q2 2026 roadmap design spec from multi-persona audit

Full-project audit using 5 parallel analytical personas (Performance,
SQL Compatibility, API/DX, Competitive, Community). Synthesizes into
prioritized P0–P3 roadmap covering: HN launch, query fingerprinting,
linter expansion to 30 rules, DML transforms, C binding hardening,
live DB schema introspection, SQL transpilation, CONNECT BY, OTel,
GORM integration, and advisor expansion.

Corresponding GitHub issues: #442–#460

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* docs: add Q2 2026 implementation plans for all roadmap items

12 implementation plans covering all prioritized GitHub issues:

P0 (Critical):
- 2026-03-29-sentry-fixes.md (#434, #437) — fix Sentry noise filters
- 2026-03-29-openssf-scorecard.md (#443) — security scorecard badge

P1 (High Priority):
- 2026-03-29-query-fingerprinting.md (#444) — SQL normalization + SHA-256 fingerprints
- 2026-03-29-linter-expansion.md (#445) — L011-L030 safety/performance/naming rules
- 2026-03-29-dml-transforms.md (#446) — SET clause and RETURNING transforms
- 2026-03-29-cbinding-hardening.md (#447) — C binding coverage + stress tests
- 2026-03-29-advisor-expansion.md (#453) — OPT-009 through OPT-020 advisor rules

P2 (Medium Priority):
- 2026-03-29-sql-parser-additions.md (#450, #454, #455, #456) — DDL formatter, CONNECT BY, SAMPLE, PIVOT/UNPIVOT
- 2026-03-29-schema-introspection.md (#448) — live DB schema introspection (Postgres, MySQL, SQLite)
- 2026-03-29-integrations.md (#451, #452) — OpenTelemetry + GORM sub-modules
- 2026-03-29-sql-transpilation.md (#449) — SQL dialect transpilation API

P3 (Low Priority):
- 2026-03-29-p3-items.md (#458, #459, #460) — CLI watch registration, pool stats, JSON functions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(linter): add safety (L011-L015), performance (L016-L023), naming (L024-L030) rules (#445)

Expand linter from 10 to 30 rules across three new sub-packages:

Safety (L011-L015):
- L011: DELETE without WHERE (error)
- L012: UPDATE without WHERE (error)
- L013: DROP without IF EXISTS (warning)
- L014: TRUNCATE TABLE warning
- L015: SELECT INTO OUTFILE/DUMPFILE (error, text-level)

Performance (L016-L023):
- L016: SELECT * (warning)
- L017: Missing WHERE on full-table SELECT (warning)
- L018: Leading wildcard LIKE '%...' (warning)
- L019: NOT IN (subquery) NULL risk (warning)
- L020: Correlated subquery in SELECT list / N+1 (warning)
- L021: OR instead of IN for same column (warning)
- L022: Function on indexed column in WHERE (warning)
- L023: Implicit cross join via comma tables (warning)

Naming/style (L024-L030):
- L024: Table alias required in multi-table queries (warning)
- L025: Reserved keyword used as identifier (warning)
- L026: Implicit column list in INSERT (warning)
- L027: UNION instead of UNION ALL (warning)
- L028: LIMIT without ORDER BY (warning)
- L029: EXISTS/IN subquery can be a JOIN (warning)
- L030: DISTINCT on many columns (warning)

All rules: AST-based where possible, visitor pattern for deep traversal,
no auto-fix for destructive/semantic changes, TDD with violation and
no-violation test cases, race-detector clean.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(linter): address PR #467 review feedback

- Add DropSequenceStatement case arm to L013 (drop_without_condition)
- Extend function_on_column visitor to traverse HAVING clauses and CTEs
- Remove unnecessary join := join copy in range loop
- Use neutral location instead of misleading sel.Pos in reserved_keyword_identifier
- Keep OR-to-IN threshold at 3 (consistent with existing tests)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Ajit Pratap Singh <ajitpratapsingh@Ajits-Mac-mini-2655.local>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

pkg/linter/rule.go

@@ -229,16 +229,41 @@ func (r BaseRule) CanAutoFix() bool {
 // Use this to validate that user-specified rule names in configuration
 // files (e.g., .gosqlx.yml) reference actual rules.
 var ValidRuleIDs = map[string]string{
+	// Whitespace rules
 	"L001": "Trailing Whitespace",
 	"L002": "Mixed Indentation",
 	"L003": "Consecutive Blank Lines",
 	"L004": "Indentation Depth",
 	"L005": "Long Lines",
 	"L006": "Column Alignment",
+	// Style rules
 	"L007": "Keyword Case Consistency",
 	"L008": "Comma Placement",
 	"L009": "Aliasing Consistency",
 	"L010": "Redundant Whitespace",
+	// Safety rules
+	"L011": "Delete Without WHERE",
+	"L012": "Update Without WHERE",
+	"L013": "Drop Without IF EXISTS",
+	"L014": "Truncate Table",
+	"L015": "Select Into Outfile",
+	// Performance rules
+	"L016": "Select Star",
+	"L017": "Missing WHERE on Full Scan",
+	"L018": "Leading Wildcard LIKE",
+	"L019": "NOT IN With NULL Risk",
+	"L020": "Correlated Subquery in SELECT",
+	"L021": "OR Instead of IN",
+	"L022": "Function on Indexed Column",
+	"L023": "Implicit Cross Join",
+	// Naming/style rules
+	"L024": "Table Alias Required",
+	"L025": "Reserved Keyword Identifier",
+	"L026": "Implicit Column List in INSERT",
+	"L027": "UNION Instead of UNION ALL",
+	"L028": "Missing ORDER BY with LIMIT",
+	"L029": "Subquery Can Be JOIN",
+	"L030": "Distinct on Many Columns",
 }
 
 // IsValidRuleID checks whether a rule ID corresponds to an implemented rule.

pkg/linter/rules/naming/distinct_on_many_columns.go

@@ -0,0 +1,76 @@
+// Copyright 2026 GoSQLX Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package naming
+
+import (
+	"fmt"
+
+	"github.com/ajitpratap0/GoSQLX/pkg/linter"
+	"github.com/ajitpratap0/GoSQLX/pkg/sql/ast"
+)
+
+const distinctColumnThreshold = 5
+
+// DistinctOnManyColumnsRule (L030) warns when DISTINCT is used with many columns.
+// DISTINCT on many columns is often a sign of a missing GROUP BY or denormalized
+// data. It also forces a sort over all projected columns, which is expensive.
+type DistinctOnManyColumnsRule struct{ linter.BaseRule }
+
+// NewDistinctOnManyColumnsRule creates a new L030 rule instance.
+func NewDistinctOnManyColumnsRule() *DistinctOnManyColumnsRule {
+	return &DistinctOnManyColumnsRule{
+		BaseRule: linter.NewBaseRule(
+			"L030",
+			"Distinct on Many Columns",
+			"DISTINCT on many columns suggests a missing GROUP BY or data quality issue",
+			linter.SeverityWarning,
+			false,
+		),
+	}
+}
+
+// Check inspects SELECT statements for DISTINCT with many columns.
+func (r *DistinctOnManyColumnsRule) Check(ctx *linter.Context) ([]linter.Violation, error) {
+	if ctx.AST == nil {
+		return nil, nil
+	}
+	var violations []linter.Violation
+	for _, stmt := range ctx.AST.Statements {
+		sel, ok := stmt.(*ast.SelectStatement)
+		if !ok {
+			continue
+		}
+		if !sel.Distinct {
+			continue
+		}
+		colCount := len(sel.Columns)
+		if colCount >= distinctColumnThreshold {
+			violations = append(violations, linter.Violation{
+				Rule:       r.ID(),
+				RuleName:   r.Name(),
+				Severity:   r.Severity(),
+				Message:    fmt.Sprintf("DISTINCT on %d columns is expensive and may indicate a missing GROUP BY or join issue", colCount),
+				Location:   sel.Pos,
+				Suggestion: "Consider using GROUP BY with aggregate functions, or investigate whether the query structure can be simplified",
+			})
+		}
+	}
+	return violations, nil
+}
+
+// Fix is a no-op: replacing DISTINCT with GROUP BY requires semantic understanding.
+func (r *DistinctOnManyColumnsRule) Fix(content string, violations []linter.Violation) (string, error) {
+	return content, nil
+}

pkg/linter/rules/naming/doc.go

@@ -0,0 +1,25 @@
+// Copyright 2026 GoSQLX Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package naming provides linter rules for SQL naming conventions and style.
+//
+// Rules:
+//   - L024: Table alias required (multi-table queries)
+//   - L025: Reserved keyword used as identifier
+//   - L026: Implicit column list in INSERT
+//   - L027: UNION instead of UNION ALL
+//   - L028: Missing ORDER BY with LIMIT
+//   - L029: Subquery in WHERE can be a JOIN
+//   - L030: DISTINCT on many columns
+package naming

pkg/linter/rules/naming/implicit_column_list.go

@@ -0,0 +1,68 @@
+// Copyright 2026 GoSQLX Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package naming
+
+import (
+	"github.com/ajitpratap0/GoSQLX/pkg/linter"
+	"github.com/ajitpratap0/GoSQLX/pkg/sql/ast"
+)
+
+// ImplicitColumnListRule (L026) flags INSERT statements without an explicit column list.
+// INSERT INTO table VALUES (...) is fragile — it breaks when columns are added/reordered.
+type ImplicitColumnListRule struct{ linter.BaseRule }
+
+// NewImplicitColumnListRule creates a new L026 rule instance.
+func NewImplicitColumnListRule() *ImplicitColumnListRule {
+	return &ImplicitColumnListRule{
+		BaseRule: linter.NewBaseRule(
+			"L026",
+			"Implicit Column List in INSERT",
+			"INSERT without explicit column list is fragile and breaks on schema changes",
+			linter.SeverityWarning,
+			false,
+		),
+	}
+}
+
+// Check inspects INSERT statements for missing column lists.
+func (r *ImplicitColumnListRule) Check(ctx *linter.Context) ([]linter.Violation, error) {
+	if ctx.AST == nil {
+		return nil, nil
+	}
+	var violations []linter.Violation
+	for _, stmt := range ctx.AST.Statements {
+		ins, ok := stmt.(*ast.InsertStatement)
+		if !ok {
+			continue
+		}
+		// If there are VALUES but no explicit column list, flag it
+		if len(ins.Values) > 0 && len(ins.Columns) == 0 {
+			violations = append(violations, linter.Violation{
+				Rule:       r.ID(),
+				RuleName:   r.Name(),
+				Severity:   r.Severity(),
+				Message:    "INSERT INTO " + ins.TableName + " has no explicit column list",
+				Location:   ins.Pos,
+				Suggestion: "Specify columns explicitly: INSERT INTO " + ins.TableName + " (col1, col2, ...) VALUES (...)",
+			})
+		}
+	}
+	return violations, nil
+}
+
+// Fix is a no-op: adding column list requires schema knowledge.
+func (r *ImplicitColumnListRule) Fix(content string, violations []linter.Violation) (string, error) {
+	return content, nil
+}

pkg/linter/rules/naming/missing_order_by_limit.go

@@ -0,0 +1,78 @@
+// Copyright 2026 GoSQLX Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package naming
+
+import (
+	"github.com/ajitpratap0/GoSQLX/pkg/linter"
+	"github.com/ajitpratap0/GoSQLX/pkg/sql/ast"
+)
+
+// MissingOrderByLimitRule (L028) flags queries that use LIMIT/OFFSET without ORDER BY.
+// Without ORDER BY, the rows returned by LIMIT are non-deterministic — different
+// executions may return different rows, making pagination unreliable.
+type MissingOrderByLimitRule struct{ linter.BaseRule }
+
+// NewMissingOrderByLimitRule creates a new L028 rule instance.
+func NewMissingOrderByLimitRule() *MissingOrderByLimitRule {
+	return &MissingOrderByLimitRule{
+		BaseRule: linter.NewBaseRule(
+			"L028",
+			"Missing ORDER BY with LIMIT",
+			"LIMIT without ORDER BY produces non-deterministic results",
+			linter.SeverityWarning,
+			false,
+		),
+	}
+}
+
+// Check inspects SELECT statements for LIMIT/OFFSET without ORDER BY.
+func (r *MissingOrderByLimitRule) Check(ctx *linter.Context) ([]linter.Violation, error) {
+	if ctx.AST == nil {
+		return nil, nil
+	}
+	var violations []linter.Violation
+	for _, stmt := range ctx.AST.Statements {
+		sel, ok := stmt.(*ast.SelectStatement)
+		if !ok {
+			continue
+		}
+		hasLimit := sel.Limit != nil || sel.Fetch != nil
+		if !hasLimit {
+			continue
+		}
+		hasOffset := sel.Offset != nil || (sel.Fetch != nil && sel.Fetch.OffsetValue != nil)
+		hasOrderBy := len(sel.OrderBy) > 0
+		if !hasOrderBy {
+			msg := "LIMIT without ORDER BY produces non-deterministic results"
+			if hasOffset {
+				msg = "LIMIT/OFFSET without ORDER BY produces non-deterministic pagination"
+			}
+			violations = append(violations, linter.Violation{
+				Rule:       r.ID(),
+				RuleName:   r.Name(),
+				Severity:   r.Severity(),
+				Message:    msg,
+				Location:   sel.Pos,
+				Suggestion: "Add ORDER BY to ensure deterministic row selection with LIMIT",
+			})
+		}
+	}
+	return violations, nil
+}
+
+// Fix is a no-op: choosing the right ORDER BY requires business logic.
+func (r *MissingOrderByLimitRule) Fix(content string, violations []linter.Violation) (string, error) {
+	return content, nil
+}