Nice — CI-gating query regressions is underrated. I've worked on static detection of SELECT * / string-concat SQL and the hard part is dynamic queries: how do you handle queries built at runtime vs the ones you can see statically?