The current sqlvet requires full parsing of the entire main package(s), so it becomes pretty slow for a large codebase. There's conveniently an article about using "go vet"'s analysis.Analyzer framework to detect SQL statements:
https://agniva.me/vet/2019/01/21/vet-analyzer.html
Does it make sense to rewrite sqlvet using it? I can try my hand over the holidays if you think it's a good idea.