id: no-sqlx-runtime
language: rust
severity: warning
category: correctness
message: "sqlx::query() runtime. Use sqlx::query!() for compile-time verification."
note: "The variants without ! (query, query_as, query_scalar) do not verify SQL at compile time. Acceptable for dynamic queries with conditional WHERE clauses."
rule:
kind: call_expression
has:
field: function
any:
- kind: scoped_identifier
regex: '^sqlx::(query|query_as|query_scalar)$'
- kind: generic_function
has:
field: function
regex: '^sqlx::(query|query_as|query_scalar)$'
ignores:
- "**/tests/**"
- "**/test_*"
- "**/*_test.rs"
- "**/fixtures/**"
skip_test_code: true
tests:
should_match:
- 'sqlx::query("SELECT * FROM users").fetch_all(&pool).await;'
- 'sqlx::query_as::<_, User>("SELECT * FROM users").fetch_one(&pool).await;'
should_not_match:
- 'sqlx::query!("SELECT * FROM users").fetch_all(&pool).await;'
- 'sqlx::query_as!(User, "SELECT * FROM users").fetch_one(&pool).await;'