diff --git a/.golangci.yml b/.golangci.yml
index 4f91ccf..7b5439f 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,35 +1,34 @@
 linters-settings:
   exhaustive:
     default-signifies-exhaustive: true
-
   gocritic:
     # The list of supported checkers can be find in https://go-critic.github.io/overview.
     settings:
       underef:
         # Whether to skip (*x).method() calls where x is a pointer receiver.
         skipRecvDeref: false
-
+      ruleguard:
+        rules: ${configDir}/tools/rules.go
+    enabled-checks:
+      - ruleguard
   govet:
     enable-all: true
     disable:
       - fieldalignment # too strict
       - shadow # complains too much about shadowing errors. All research points to this being fine.
-
   nakedret:
     max-func-lines: 0
-
   nolintlint:
-    allow-no-explanation: [ forbidigo, tracecheck, gomnd, gochecknoinits, makezero ]
+    allow-no-explanation: [forbidigo, tracecheck, gomnd, gochecknoinits, makezero]
     require-explanation: true
     require-specific: true
-
   revive:
     ignore-generated-header: true
     severity: error
     rules:
       - name: atomic
       - name: line-length-limit
-        arguments: [ 200 ]
+        arguments: [200]
       # These are functions that we use without checking the errors often. Most of these can't return an error even
       # though they implement an interface that can.
       - name: unhandled-error
@@ -46,14 +45,10 @@ linters-settings:
           - os.RemoveAll
       - name: var-naming
         arguments: [["ID", "URL", "HTTP", "API"], []]
-
   tenv:
     all: true
-
   varcheck:
     exported-fields: false # this appears to improperly detect exported variables as unused when they are used from a package with the same name
-
-
 linters:
   disable-all: true
   enable:
@@ -70,9 +65,7 @@ linters:
     - bodyclose # checks whether HTTP response body is closed successfully
     - durationcheck # check for two durations multiplied together
     - errorlint # errorlint is a linter for that can be used to find code that will cause problems with the error wrapping scheme introduced in Go 1.13.
-    - execinquery # execinquery is a linter about query string checker in Query function which reads your Go src files and warning it finds
     - exhaustive # check exhaustiveness of enum switch statements
-    - exportloopref # checks for pointers to enclosing loop variables
     - forbidigo # Forbids identifiers
     - gochecknoinits # Checks that no init functions are present in Go code
     - goconst # Finds repeated strings that could be replaced by a constant
@@ -95,11 +88,9 @@ linters:
     - unconvert # Remove unnecessary type conversions
     - usestdlibvars # detect the possibility to use variables/constants from the Go standard library
     - whitespace # Tool for detection of leading and trailing whitespace
-
 issues:
   max-same-issues: 50
-
   exclude-rules:
     # Don't require TODO comments to end in a period
     - source: "(TODO)"
-      linters: [ godot ]
+      linters: [godot]
diff --git a/go.mod b/go.mod
index 0852cd8..3ffec89 100644
--- a/go.mod
+++ b/go.mod
@@ -5,7 +5,9 @@ go 1.23
 require (
 	github.com/PagerDuty/go-pagerduty v1.8.0
 	github.com/conductorone/baton-sdk v0.1.28
+	github.com/ennyjfrick/ruleguard-logfatal v0.0.2
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
+	github.com/quasilyte/go-ruleguard/dsl v0.3.22
 	github.com/spf13/cobra v1.8.0
 	go.uber.org/zap v1.27.0
 	golang.org/x/text v0.14.0
@@ -79,7 +81,7 @@ require (
 	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
 	golang.org/x/net v0.22.0 // indirect
 	golang.org/x/oauth2 v0.18.0 // indirect
-	golang.org/x/sync v0.6.0 // indirect
+	golang.org/x/sync v0.11.0 // indirect
 	golang.org/x/sys v0.18.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 // indirect
diff --git a/go.sum b/go.sum
index 844c7bd..e413065 100644
--- a/go.sum
+++ b/go.sum
@@ -64,6 +64,8 @@ github.com/doug-martin/goqu/v9 v9.19.0 h1:PD7t1X3tRcUiSdc5TEyOFKujZA5gs3VSA7wxSv
 github.com/doug-martin/goqu/v9 v9.19.0/go.mod h1:nf0Wc2/hV3gYK9LiyqIrzBEVGlI8qW3GuDCEobC4wBQ=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/ennyjfrick/ruleguard-logfatal v0.0.2 h1:FlNMe9+h029VZVD8n6YdFzZAQz/aA8y6WSZttg50yBM=
+github.com/ennyjfrick/ruleguard-logfatal v0.0.2/go.mod h1:Ng4Cc8dzYEo8vzB2xd+IOxsO8X1OqO9mNnY4jbngQac=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
@@ -85,6 +87,10 @@ github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-toolsmith/astcopy v1.0.2 h1:YnWf5Rnh1hUudj11kei53kI57quN/VH6Hp1n+erozn0=
+github.com/go-toolsmith/astcopy v1.0.2/go.mod h1:4TcEdbElGc9twQEYpVo/aieIXfHhiuLh4aLAck6dO7Y=
+github.com/go-toolsmith/astequal v1.0.3 h1:+LVdyRatFS+XO78SGV4I3TCEA0AC7fKEGma+fH+674o=
+github.com/go-toolsmith/astequal v1.0.3/go.mod h1:9Ai4UglvtR+4up+bAD4+hCj7iTo4m/OXVTSLnCyTAx4=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
@@ -159,6 +165,14 @@ github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:Om
 github.com/pquerna/xjwt v0.2.0 h1:+RrTRRRqgG2RhYfmcs1WR8/4OrxShvqcVET7Rcb8A7o=
 github.com/pquerna/xjwt v0.2.0/go.mod h1:xkrUYjBzqP3vBET2QdLkjLTcpPFa0bhPa3H445NgZEM=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/quasilyte/go-ruleguard v0.4.4 h1:53DncefIeLX3qEpjzlS1lyUmQoUEeOWPFWqaTJq9eAQ=
+github.com/quasilyte/go-ruleguard v0.4.4/go.mod h1:Vl05zJ538vcEEwu16V/Hdu7IYZWyKSwIy4c88Ro1kRE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22 h1:wd8zkOhSNr+I+8Qeciml08ivDt1pSXe60+5DqOpCjPE=
+github.com/quasilyte/go-ruleguard/dsl v0.3.22/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU=
+github.com/quasilyte/gogrep v0.5.0 h1:eTKODPXbI8ffJMN+W2aE0+oL0z/nh8/5eNdiO34SOAo=
+github.com/quasilyte/gogrep v0.5.0/go.mod h1:Cm9lpz9NZjEoL1tgZ2OgeUKPIxL1meE7eo60Z6Sk+Ng=
+github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4lu7Gd+PU1fV2/qnDNfzT635KRSObncs=
+github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
@@ -241,6 +255,8 @@ golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOM
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
 golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
+golang.org/x/exp/typeparams v0.0.0-20240213143201-ec583247a57a h1:rrd/FiSCWtI24jk057yBSfEfHrzzjXva1VkDNWRXMag=
+golang.org/x/exp/typeparams v0.0.0-20240213143201-ec583247a57a/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
@@ -249,8 +265,8 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.16.0 h1:QX4fJ0Rr5cPQCF7O9lh9Se4pmwfwskqZfq5moyldzic=
-golang.org/x/mod v0.16.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
+golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -275,8 +291,8 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
-golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -323,8 +339,8 @@ golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.19.0 h1:tfGCXNR1OsFG+sVdLAitlpjAvD/I6dHDKnYrpEZUHkw=
-golang.org/x/tools v0.19.0/go.mod h1:qoJWxmGSIBmAeriMx19ogtrEPrGtDbPK634QFIcLAhc=
+golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
+golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/tools/rules.go b/tools/rules.go
new file mode 100644
index 0000000..be515fc
--- /dev/null
+++ b/tools/rules.go
@@ -0,0 +1,14 @@
+//go:build ruleguard
+// +build ruleguard
+
+package gorules
+
+import (
+	"github.com/quasilyte/go-ruleguard/dsl"
+
+	logfatalrules "github.com/ennyjfrick/ruleguard-logfatal"
+)
+
+func init() {
+	dsl.ImportRules("logfatal", logfatalrules.Bundle) // checks for uses of log.Fatal or log.Panic
+}
diff --git a/vendor/github.com/ennyjfrick/ruleguard-logfatal/.gitignore b/vendor/github.com/ennyjfrick/ruleguard-logfatal/.gitignore
new file mode 100644
index 0000000..64ae7f3
--- /dev/null
+++ b/vendor/github.com/ennyjfrick/ruleguard-logfatal/.gitignore
@@ -0,0 +1,25 @@
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+go.work.sum
+
+# env file
+.env
\ No newline at end of file
diff --git a/vendor/github.com/ennyjfrick/ruleguard-logfatal/LICENSE b/vendor/github.com/ennyjfrick/ruleguard-logfatal/LICENSE
new file mode 100644
index 0000000..df02e43
--- /dev/null
+++ b/vendor/github.com/ennyjfrick/ruleguard-logfatal/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Enny J. Frick
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vendor/github.com/ennyjfrick/ruleguard-logfatal/README.md b/vendor/github.com/ennyjfrick/ruleguard-logfatal/README.md
new file mode 100644
index 0000000..6956f5b
--- /dev/null
+++ b/vendor/github.com/ennyjfrick/ruleguard-logfatal/README.md
@@ -0,0 +1,96 @@
+# `ruleguard-logfatal`: A `ruleguard` bundle for better log hygiene
+
+`ruleguard-logfatal` is a [`ruleguard`](https://github.com/quasilyte/go-ruleguard) bundle that enforces the absence of logging at `Fatal` or `Panic` levels in a codebase.
+
+It supports most well-known logging libraries with a `Fatal` and/or `Panic` level, including [`zap`](https://github.com/uber-go/zap), [`logrus`](https://github.com/sirupsen/logrus), [`zerolog`](https://github.com/rs/zerolog), and the standard library's [`log`](https://pkg.go.dev/log) package. If you're not using one of these libraries, it should still work just fine if your library has an  API similar to any of the above; you can look at the custom logger interface in [`_example/examples.go`](./_example/example.go) as an example.
+
+## Motivation
+
+Quite simply: _it is better to propagate errors so they can be handled rather than crash an application_.
+
+Errors should be propagated and handled accordingly, rather than cause an application to crash; using `Fatal` makes it too easy to be haphazard about failure modes. It is _especially_ important to be considerate of error handling in library; no one wants their application to crash because a dependency decided to call `os.Exit(1)`! Logging at `Panic` is slightly better due to `recover`, but suffers from the same problem: if you don't know it exists in your dependency, you won't know to use `recover`.
+
+## Usage
+
+### Installation
+
+Install `ruleguard-logfatal` like you would any other `ruleguard` bundle:
+1. If you're not using `golangci-lint`, then [get `ruleguard` first](https://github.com/quasilyte/go-ruleguard?tab=readme-ov-file#quick-start)
+2. `go get -u github.com/ennyjfrick/ruleguard-logfatal@latest`
+3. Create a `rules.go` with the following content somewhere in your project directory:
+```go
+//go:build ruleguard
+// +build ruleguard
+
+package gorules
+
+import (
+	"github.com/quasilyte/go-ruleguard/dsl"
+
+	logfatalrules "github.com/ennyjfrick/ruleguard-logfatal"
+)
+
+func init() {
+	dsl.ImportRules("logfatal", logfatalrules.Bundle)
+}
+```
+4. If you're using `ruleguard` as a standalone tool, just point it at your new `rules.go` file:
+```shell
+$ ruleguard -rules /path/to/rules.go ./...
+```
+5. Otherwise, if you're using `ruleguard` through `golangci-lint`, add the following to your `.golangci.yml`:
+```yaml
+linters:
+  enable:
+    - gocritic
+linters-settings:
+  gocritic:
+    enabled-checks:
+      - ruleguard
+    settings:
+      ruleguard:
+        rules: "rules.go"
+```
+
+### Customization
+
+As a `ruleguard` bundle, `ruleguard-logfatal` uses the parent `ruleguard` configuration.
+
+#### Disabling or Enabling Rule Groups
+
+`ruleguard-logfatal` has the following two rule groups:
+- `noFatal`: checks for logging at the `Fatal` level
+- `noPanic`: checks for logging at the `Panic` level
+
+To enable or disable a group, simply pass the prefix you set in the `dsl.ImportRules` call plus the group name to the appropriate `ruleguard` flags. For example, to disable `noPanic`:
+```shell
+# using ruleguard as a standalone tool
+$ ruleguard -rules rules.go -disable logfatal/noPanic . # to disable the check for logging at `Panic`
+# alternatively: ruleguard -rules rules.go -enable logfatal/noFatal .
+```
+```yaml
+# using ruleguard through golangci-lint
+linters:
+  enable:
+    - gocritic
+linters-settings:
+  gocritic:
+    enabled-checks:
+      - ruleguard
+    settings:
+      ruleguard:
+        rules: "rules.go"
+        disable: "logfatal/noPanic"
+        # alternatively
+        # enable: "logfatal/noError"
+```
+
+## Contributing
+
+Feel free to open an [issue](https://github.com/ennyjfrick/ruleguard-logfatal/issues/new) or create a [pull request](https://github.com/ennyjfrick/ruleguard-logfatal/pulls) for any features/bugs/etc. 
+
+If you're creating a pull request, please include test cases when applicable.
+
+## TODO
+
+- [ ] add tests for example
\ No newline at end of file
diff --git a/vendor/github.com/ennyjfrick/ruleguard-logfatal/rules.go b/vendor/github.com/ennyjfrick/ruleguard-logfatal/rules.go
new file mode 100644
index 0000000..adcf243
--- /dev/null
+++ b/vendor/github.com/ennyjfrick/ruleguard-logfatal/rules.go
@@ -0,0 +1,33 @@
+package gorules
+
+import "github.com/quasilyte/go-ruleguard/dsl"
+
+var Bundle = dsl.Bundle{}
+
+func noFatal(m dsl.Matcher) { //nolint:unused // magically exported
+	m.Match(`$caller.Fatal($*_)`, `$caller.fatal($*_)`).Where(!m["caller"].Type.Is(`*testing.T`) && !m["caller"].Type.Is(`*testing.B`) && !m["caller"].Type.Is(`*testing.F`)).Report(`propagate errors rather than calling $$`) // ignore *testing.T.Fatal and equiv, but match log.Fatal and equiv
+
+	m.Match(`$caller.Fatalf($*_)`, `$caller.fatalf($*_)`).Where(!m["caller"].Type.Is(`*testing.T`) && !m["caller"].Type.Is(`*testing.B`) && !m["caller"].Type.Is(`*testing.F`)).Report(`propagate errors rather than calling $$`) // ignore *testing.T.Fatalf and equiv, but match log.Fatalf and equiv
+
+	m.Match(`$_.Fatalln($*_)`, `$_.fatalln($*_)`, `$_.Fatalw($*_)`, `$_.fatalw($*_)`).Report(`propagate errors rather than calling $$`) // catches most, if not all, x.[fF]atal(ln|w)? patterns
+
+	m.Match(`$_.FatalFn($*_)`).Report(`propagate errors rather than calling $$`) // logrus-specific pattern
+
+	m.Match(`$_.Log($level, $*_)`, `$_.Logf($level, $*_)`, `$_.Logln($level, $*_)`, `$_.Logw($level, $*_)`, `$_.log($level, $*_)`, `$_.logf($level, $*_)`, `$_.logln($level, $*_)`, `$_.logw($level, $*_)`).Where(m["level"].Text.Matches(`.*([Ll]evel)?[fF]atal([Ll]evel)?.*`)).Report(`propagate errors rather than logging at $level`) // general "log at fatal"
+
+	m.Match(`$_.LogFn($level, $*_)`).Where(m["level"].Text.Matches(`.*([Ll]evel)?[fF]atal([Ll]evel)?.*`)).Report(`propagate errors rather than logging at $level`) // logrus-specific pattern
+
+	m.Match(`$_.WithLevel($level, $*_)`).Where(m["level"].Text.Matches(`.*([Ll]evel)?[fF]atal([Ll]evel)?.*`)).Report(`propagate errors rather than logging at $level`) // zerolog-style level setting
+}
+
+func noPanic(m dsl.Matcher) { //nolint:unused // magically exported
+	m.Match(`$_.Panic($*_)`, `$_.Panicf($*_)`, `$_.Panicln($*_)`, `$_.Panicw($*_)`, `$_.panic($*_)`, `$_.panicf($*_)`, `$_.panicln($*_), $_.paniclw($*_)`).Report(`propagate errors rather than calling $$`) // catches most, if not all, x.[pP]anic(f|ln|w)? patterns
+
+	m.Match(`$_.PanicFn($*_)`).Report(`propagate errors rather than calling $$`) // logrus-specific pattern
+
+	m.Match(`$_.Log($level, $*_)`, `$_.Logf($level, $*_)`, `$_.Logln($level, $*_)`, `$_.Logw($level, $*_)`, `$_.log($level, $*_)`, `$_.logf($level, $*_)`, `$_.logln($level, $*_)`, `$_.logw($level, $*_)`).Where(m["level"].Text.Matches(`.*([Ll]evel)?[Pp]anic([Ll]evel)?.*`)).Report(`propagate errors rather than logging at $level`) // general "log at fatal"
+
+	m.Match(`$_.LogFn($level, $*_)`).Where(m["level"].Text.Matches(`.*([Ll]evel)?[Pp]anic([Ll]evel)?.*`)).Report(`propagate errors rather than logging at $level`) // logrus-specific pattern
+
+	m.Match(`$_.WithLevel($level, $*_)`).Where(m["level"].Text.Matches(`.*([Ll]evel)?[Pp]anic([Ll]evel)?.*`)).Report(`propagate errors rather than logging at $level`) // zerolog-style level setting
+}
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/LICENSE b/vendor/github.com/quasilyte/go-ruleguard/dsl/LICENSE
new file mode 100644
index 0000000..558f81f
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/LICENSE
@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2022, Iskander (Alex) Sharipov / quasilyte
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/bundle.go b/vendor/github.com/quasilyte/go-ruleguard/dsl/bundle.go
new file mode 100644
index 0000000..45a9455
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/bundle.go
@@ -0,0 +1,19 @@
+package dsl
+
+// Bundle is a rules file export manifest.
+type Bundle struct {
+	// TODO: figure out which fields we might want to add here.
+}
+
+// ImportRules imports all rules from the bundle and prefixes them with a specified string.
+//
+// Empty string prefix is something like "dot import" in Go.
+// Group name collisions will result in an error.
+//
+// Only packages that have an exported Bundle variable can be imported.
+//
+// Note: right now imported bundle can't import other bundles.
+// This is not a fundamental limitation but rather a precaution
+// measure before we understand how it should work better.
+// If you need this feature, please open an issue at github.com/quasilyte/go-ruleguard.
+func ImportRules(prefix string, bundle Bundle) {}
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/do.go b/vendor/github.com/quasilyte/go-ruleguard/dsl/do.go
new file mode 100644
index 0000000..86bc163
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/do.go
@@ -0,0 +1,19 @@
+package dsl
+
+import (
+	"github.com/quasilyte/go-ruleguard/dsl/types"
+)
+
+type DoContext struct{}
+
+func (*DoContext) Var(varname string) *DoVar { return nil }
+
+func (*DoContext) SetReport(report string) {}
+
+func (*DoContext) SetSuggest(suggest string) {}
+
+type DoVar struct{}
+
+func (*DoVar) Text() string { return "" }
+
+func (*DoVar) Type() types.Type { return nil }
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/dsl.go b/vendor/github.com/quasilyte/go-ruleguard/dsl/dsl.go
new file mode 100644
index 0000000..d3c73bd
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/dsl.go
@@ -0,0 +1,361 @@
+package dsl
+
+// Matcher is a main API group-level entry point.
+// It's used to define and configure the group rules.
+// It also represents a map of all rule-local variables.
+type Matcher map[string]Var
+
+// Import loads given package path into a rule group imports table.
+//
+// That table is used during the rules compilation.
+//
+// The table has the following effect on the rules:
+//	* For type expressions, it's used to resolve the
+//	  full package paths of qualified types, like `foo.Bar`.
+//	  If Import(`a/b/foo`) is called, `foo.Bar` will match
+//	  `a/b/foo.Bar` type during the pattern execution.
+func (m Matcher) Import(pkgPath string) {}
+
+// Match specifies a set of patterns that match a rule being defined.
+// Pattern matching succeeds if at least 1 pattern matches.
+//
+// If none of the given patterns matched, rule execution stops.
+func (m Matcher) Match(pattern string, alternatives ...string) Matcher {
+	return m
+}
+
+// MatchComment is like Match, but handles only comments and uses regexp patterns.
+//
+// Multi-line /**/ comments are passed as a single string.
+// Single-line // comments are passed line-by-line.
+//
+// Hint: if you want to match a plain text and don't want to do meta char escaping,
+// prepend `\Q` to your pattern. `\Qf(x)` will match `f(x)` as a plain text
+// and there is no need to escape the `(` and `)` chars.
+//
+// Named regexp capture groups can be accessed using the usual indexing notation.
+//
+// Given this pattern:
+//
+//     `(?P<first>\d+)\.(\d+).(?P<second>\d+)`
+//
+// And this input comment: `// 14.6.600`
+//
+// We'll get these submatches:
+//
+//     m["$$"] => `14.6.600`
+//     m["first"] => `14`
+//     m["second"] => `600`
+//
+// All usual filters can be applied:
+//
+//     Where(!m["first"].Text.Matches(`foo`))
+//
+// You can use this to reject some matches (allow-list behavior).
+func (m Matcher) MatchComment(pattern string, alternatives ...string) Matcher {
+	return m
+}
+
+// Where applies additional constraint to a match.
+// If a given cond is not satisfied, a match is rejected and
+// rule execution stops.
+func (m Matcher) Where(cond bool) Matcher {
+	return m
+}
+
+// Report prints a message if associated rule match is successful.
+//
+// A message is a string that can contain interpolated expressions.
+// For every matched variable it's possible to interpolate
+// their printed representation into the message text with $<name>.
+// An entire match can be addressed with $$.
+func (m Matcher) Report(message string) Matcher {
+	return m
+}
+
+// Suggest assigns a quickfix suggestion for the matched code.
+func (m Matcher) Suggest(suggestion string) Matcher {
+	return m
+}
+
+func (m Matcher) Do(fn func(*DoContext)) Matcher {
+	return m
+}
+
+// At binds the reported node to a named submatch.
+// If no explicit location is given, the outermost node ($$) is used.
+func (m Matcher) At(v Var) Matcher {
+	return m
+}
+
+// File returns the current file context.
+func (m Matcher) File() File { return File{} }
+
+// GoVersion returns the analyzer associated target Go language version.
+func (m Matcher) GoVersion() GoVersion { return GoVersion{} }
+
+// Deadcode reports whether this match is contained inside a dead code path.
+func (m Matcher) Deadcode() bool { return boolResult }
+
+// Var is a pattern variable that describes a named submatch.
+type Var struct {
+	// Pure reports whether expr matched by var is side-effect-free.
+	Pure bool
+
+	// Const reports whether expr matched by var is a constant value.
+	Const bool
+
+	// ConstSlice reports whether expr matched by var is a slice literal
+	// consisting of contant elements.
+	//
+	// We need a separate Const-like predicate here because Go doesn't
+	// treat slices of const elements as constants, so including
+	// them in Const would be incorrect.
+	// Use `m["x"].Const || m["x"].ConstSlice` when you need
+	// to have extended definition of "constant value".
+	//
+	// Some examples:
+	//     []byte("foo") -- constant byte slice
+	//     []byte{'f', 'o', 'o'} -- same constant byte slice
+	//     []int{1, 2} -- constant int slice
+	ConstSlice bool
+
+	// Value is a compile-time computable value of the expression.
+	Value ExprValue
+
+	// Addressable reports whether the corresponding expression is addressable.
+	// See https://golang.org/ref/spec#Address_operators.
+	Addressable bool
+
+	// Comparable reports whether the corresponding expression value is comparable.
+	// See https://pkg.go.dev/go/types#Comparable.
+	Comparable bool
+
+	// Type is a type of a matched expr.
+	//
+	// For function call expressions, a type is a function result type,
+	// but for a function expression itself it's a *types.Signature.
+	//
+	// Suppose we have a `a.b()` expression:
+	//	`$x()` m["x"].Type is `a.b` function type
+	//	`$x` m["x"].Type is `a.b()` function call result type
+	Type ExprType
+
+	SinkType SinkType
+
+	// Object is an associated "go/types" Object.
+	Object TypesObject
+
+	// Text is a captured node text as in the source code.
+	Text MatchedText
+
+	// Node is a captured AST node.
+	Node MatchedNode
+
+	// Line is a source code line number that contains this match.
+	// If this match is multi-line, this is the first line number.
+	Line int
+}
+
+// Filter applies a custom predicate function on a submatch.
+//
+// The callback function should use VarFilterContext to access the
+// information that is usually accessed through Var.
+// For example, `VarFilterContext.Type` is mapped to `Var.Type`.
+func (Var) Filter(pred func(*VarFilterContext) bool) bool { return boolResult }
+
+// Contains runs a sub-search from a given pattern using the captured
+// vars from the original pattern match.
+//
+// For example, given the Match(`$lhs = append($lhs, $x)`) pattern,
+// we can do m["lhs"].Contains(`$x`) and learn whether $lhs contains
+// $x as its sub-expression.
+//
+// Experimental: this function is not part of the stable API.
+func (Var) Contains(pattern string) bool { return boolResult }
+
+// MatchedNode represents an AST node associated with a named submatch.
+type MatchedNode struct{}
+
+// Is reports whether a matched node AST type is compatible with the specified type.
+// A valid argument is a ast.Node implementing type name from the "go/ast" package.
+// Examples: "BasicLit", "Expr", "Stmt", "Ident", "ParenExpr".
+// See https://golang.org/pkg/go/ast/.
+func (MatchedNode) Is(typ string) bool { return boolResult }
+
+// Parent returns a matched node parent.
+func (MatchedNode) Parent() Node { return Node{} }
+
+// Node represents an AST node somewhere inside a match.
+// Unlike MatchedNode, it doesn't have to be associated with a named submatch.
+type Node struct{}
+
+// Is reports whether a node AST type is compatible with the specified type.
+// See `MatchedNode.Is` for the full reference.
+func (Node) Is(typ string) bool { return boolResult }
+
+// ExprValue describes a compile-time computable value of a matched expr.
+type ExprValue struct{}
+
+// Int returns compile-time computable int value of the expression.
+// If value can't be computed, condition will fail.
+func (ExprValue) Int() int { return intResult }
+
+// TypesObject is a types.Object mapping.
+type TypesObject struct{}
+
+// Is reports whether an associated types.Object is compatible with the specified type.
+// A valid argument is a types.Object type name from the "go/types" package.
+// Examples: "Func", "Var", "Const", "TypeName", "Label", "PkgName", "Builtin", "Nil"
+// See https://golang.org/pkg/go/types/.
+func (TypesObject) Is(typ string) bool { return boolResult }
+
+// IsGlobal reports whether an associated types.Object is defined in global scope.
+func (TypesObject) IsGlobal() bool { return boolResult }
+
+// IsVariadicParam reports whether this object represents a function variadic param.
+// This property is not propagated between the assignments.
+func (TypesObject) IsVariadicParam() bool { return boolResult }
+
+type SinkType struct{}
+
+// Is reports whether a type is identical to a given type.
+// Works like ExprType.Is method.
+func (SinkType) Is(typ string) bool { return boolResult }
+
+// ExprType describes a type of a matcher expr.
+type ExprType struct {
+	// Size represents expression type size in bytes.
+	//
+	// For expressions of unknown size, like type params in generics,
+	// any filter using this operand will fail.
+	Size int
+}
+
+// IdenticalTo applies types.Identical(this, v.Type) operation.
+// See https://golang.org/pkg/go/types/#Identical function documentation.
+//
+// Experimental: this function is not part of the stable API.
+func (ExprType) IdenticalTo(v Var) bool { return boolResult }
+
+// Underlying returns expression type underlying type.
+// See https://golang.org/pkg/go/types/#Type Underlying() method documentation.
+// Read https://golang.org/ref/spec#Types section to learn more about underlying types.
+func (ExprType) Underlying() ExprType { return underlyingType }
+
+// AssignableTo reports whether a type is assign-compatible with a given type.
+// See https://golang.org/pkg/go/types/#AssignableTo.
+func (ExprType) AssignableTo(typ string) bool { return boolResult }
+
+// ConvertibleTo reports whether a type is conversible to a given type.
+// See https://golang.org/pkg/go/types/#ConvertibleTo.
+func (ExprType) ConvertibleTo(typ string) bool { return boolResult }
+
+// Implements reports whether a type implements a given interface.
+// See https://golang.org/pkg/go/types/#Implements.
+func (ExprType) Implements(typ typeName) bool { return boolResult }
+
+// HasMethod reports whether a type has a given method.
+// Unlike Implements(), it will work for both value and pointer types.
+//
+// fn argument is a function signature, like `WriteString(string) (int, error)`.
+// It can also be in form of a method reference for importable types: `io.StringWriter.WriteString`.
+//
+// To avoid confusion with Implements() method, here is a hint when to use which:
+//
+//	- To check if it's possible to call F on x, use HasMethod(F)
+//	- To check if x can be passed as I interface, use Implements(I)
+func (ExprType) HasMethod(fn string) bool { return boolResult }
+
+// Is reports whether a type is identical to a given type.
+func (ExprType) Is(typ string) bool { return boolResult }
+
+// HasPointers reports whether a type contains at least one pointer.
+//
+// We try to be as close to the Go sense of pointer-free objects as possible,
+// therefore string type is not considered to be a pointer-free type.
+//
+// This function may return "true" for some complicated cases as a
+// conservative result. It never returns "false" for a type that
+// actually contains a pointer.
+//
+// So this function is mostly useful for !HasPointers() form.
+func (ExprType) HasPointers() bool { return boolResult }
+
+// OfKind reports whether a matched expr type is compatible with the specified kind.
+//
+// Only a few "kinds" are recognized, the list is provided below.
+//
+//	"integer"  -- typ is *types.Basic, where typ.Info()&types.Integer != 0
+//	"unsigned" -- typ is *types.Basic, where typ.Info()&types.Unsigned != 0
+//	"float"    -- typ is *types.Basic, where typ.Info()&types.Float != 0
+//	"complex"  -- typ is *types.Basic, where typ.Info()&types.Complex != 0
+//	"untyped"  -- typ is *types.Basic, where typ.Info()&types.Untyped != 0
+//	"numeric"  -- typ is *types.Basic, where typ.Info()&types.Numeric != 0
+//  "signed"   -- identical to `OfKind("integer") && !OfKind("unsigned")`
+//  "int"      -- int, int8, int16, int32, int64
+//  "uint"     -- uint, uint8, uint16, uint32, uint64
+//
+// Note: "int" will include "rune" as well, as it's an alias.
+// In the same manner, "uint" includes the "byte" type.
+//
+// Using OfKind("unsigned") is more efficient (and concise) than using a set
+// of or-conditions with Is("uint8"), Is("uint16") and so on.
+func (ExprType) OfKind(kind string) bool { return boolResult }
+
+// MatchedText represents a source text associated with a matched node.
+type MatchedText string
+
+// Matches reports whether the text matches the given regexp pattern.
+func (MatchedText) Matches(pattern string) bool { return boolResult }
+
+// String represents an arbitrary string-typed data.
+type String string
+
+// Matches reports whether a string matches the given regexp pattern.
+func (String) Matches(pattern string) bool { return boolResult }
+
+// File represents the current Go source file.
+type File struct {
+	// Name is a file base name.
+	Name String
+
+	// PkgPath is a file package path.
+	// Examples: "io/ioutil", "strings", "github.com/quasilyte/go-ruleguard/dsl".
+	PkgPath String
+}
+
+// Imports reports whether the current file imports the given path.
+func (File) Imports(path string) bool { return boolResult }
+
+// GoVersion is an analysis target go language version.
+// It can be compared to Go versions like "1.10", "1.16" using
+// the associated methods.
+type GoVersion struct{}
+
+// Eq asserts that target Go version is equal to (==) specified version.
+func (GoVersion) Eq(version string) bool { return boolResult }
+
+// GreaterEqThan asserts that target Go version is greater or equal than (>=) specified version.
+func (GoVersion) GreaterEqThan(version string) bool { return boolResult }
+
+// GreaterThan asserts that target Go version is greater than (>) specified version.
+func (GoVersion) GreaterThan(version string) bool { return boolResult }
+
+// LessThan asserts that target Go version is less than (<) specified version.
+func (GoVersion) LessThan(version string) bool { return boolResult }
+
+// LessEqThan asserts that target Go version is less or equal than (<=) specified version.
+func (GoVersion) LessEqThan(version string) bool { return boolResult }
+
+// typeName is a helper type used to document function params better.
+//
+// A type name can be:
+//	- builtin type name: `error`, `string`, etc.
+//	- qualified name from a standard library: `io.Reader`, etc.
+//	- fully-qualified type name, like `github.com/username/pkgname.TypeName`
+//
+// typeName is also affected by a local import table, which can override
+// how qualified names are interpreted.
+// See `Matcher.Import` for more info.
+type typeName = string
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/filter.go b/vendor/github.com/quasilyte/go-ruleguard/dsl/filter.go
new file mode 100644
index 0000000..cef8800
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/filter.go
@@ -0,0 +1,24 @@
+package dsl
+
+import (
+	"github.com/quasilyte/go-ruleguard/dsl/types"
+)
+
+// VarFilterContext carries Var and environment information into the filter function.
+// It's an input parameter type for the Var.Filter function callback.
+type VarFilterContext struct {
+	// Type is mapped to Var.Type field.
+	Type types.Type
+}
+
+// SizeOf returns the size of the given type.
+// It uses the ruleguard.Context.Sizes to calculate the result.
+func (*VarFilterContext) SizeOf(x types.Type) int { return 0 }
+
+// GetType finds a type value by a given name.
+// If a type can't be found (or a name is malformed), this function panics.
+func (*VarFilterContext) GetType(name typeName) types.Type { return nil }
+
+// GetInterface finds a type value that represents an interface by a given name.
+// Works like `types.AsInterface(ctx.GetType(name))`.
+func (*VarFilterContext) GetInterface(name typeName) *types.Interface { return nil }
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/internal.go b/vendor/github.com/quasilyte/go-ruleguard/dsl/internal.go
new file mode 100644
index 0000000..3bb6d85
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/internal.go
@@ -0,0 +1,6 @@
+package dsl
+
+var boolResult bool
+var intResult int
+
+var underlyingType ExprType
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/types/ext.go b/vendor/github.com/quasilyte/go-ruleguard/dsl/types/ext.go
new file mode 100644
index 0000000..82595ff
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/types/ext.go
@@ -0,0 +1,21 @@
+package types
+
+// AsArray is a type-assert like operation, x.(*Array), but never panics.
+// Returns nil if type is not an array.
+func AsArray(x Type) *Array { return nil }
+
+// AsSlice is a type-assert like operation, x.(*Slice), but never panics.
+// Returns nil if type is not an array.
+func AsSlice(x Type) *Slice { return nil }
+
+// AsPointer is a type-assert like operation, x.(*Pointer), but never panics.
+// Returns nil if type is not a pointer.
+func AsPointer(x Type) *Pointer { return nil }
+
+// AsStruct is a type-assert like operation, x.(*Struct), but never panics.
+// Returns nil if type is not a struct.
+func AsStruct(x Type) *Struct { return nil }
+
+// AsInterface is a type-assert like operation, x.(*Interface), but never panics.
+// Returns nil if type is not an interface.
+func AsInterface(x Type) *Interface { return nil }
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/types/type_impl.go b/vendor/github.com/quasilyte/go-ruleguard/dsl/types/type_impl.go
new file mode 100644
index 0000000..9fc71d7
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/types/type_impl.go
@@ -0,0 +1,17 @@
+package types
+
+// Method stubs to make various types implement Type interface.
+//
+// Nothing interesting here, hence it's moved to a separate file.
+
+func (*Array) String() string     { return "" }
+func (*Slice) String() string     { return "" }
+func (*Pointer) String() string   { return "" }
+func (*Interface) String() string { return "" }
+func (*Struct) String() string    { return "" }
+
+func (*Array) Underlying() Type     { return nil }
+func (*Slice) Underlying() Type     { return nil }
+func (*Pointer) Underlying() Type   { return nil }
+func (*Interface) Underlying() Type { return nil }
+func (*Struct) Underlying() Type    { return nil }
diff --git a/vendor/github.com/quasilyte/go-ruleguard/dsl/types/types.go b/vendor/github.com/quasilyte/go-ruleguard/dsl/types/types.go
new file mode 100644
index 0000000..b6be7cc
--- /dev/null
+++ b/vendor/github.com/quasilyte/go-ruleguard/dsl/types/types.go
@@ -0,0 +1,68 @@
+// Package types mimics the https://golang.org/pkg/go/types/ package.
+// It also contains some extra utility functions, they're defined in ext.go file.
+package types
+
+// Implements reports whether a given type implements the specified interface.
+func Implements(typ Type, iface *Interface) bool { return false }
+
+// Identical reports whether x and y are identical types. Receivers of Signature types are ignored.
+func Identical(x, y Type) bool { return false }
+
+// A Type represents a type of Go. All types implement the Type interface.
+type Type interface {
+	// Underlying returns the underlying type of a type.
+	Underlying() Type
+
+	// String returns a string representation of a type.
+	String() string
+}
+
+type (
+	// An Array represents an array type.
+	Array struct{}
+
+	// A Slice represents a slice type.
+	Slice struct{}
+
+	// A Pointer represents a pointer type.
+	Pointer struct{}
+
+	// An Interface represents an interface type.
+	Interface struct{}
+
+	// A struct represents a struct type.
+	Struct struct{}
+)
+
+// NewArray returns a new array type for the given element type and length.
+// A negative length indicates an unknown length.
+func NewArray(elem Type, len int) *Array { return nil }
+
+// Elem returns element type of array.
+func (*Array) Elem() Type { return nil }
+
+// NewSlice returns a new slice type for the given element type.
+func NewSlice(elem Type) *Slice { return nil }
+
+// Elem returns element type of slice.
+func (*Slice) Elem() Type { return nil }
+
+// Len returns the length of array.
+// A negative result indicates an unknown length.
+func (*Array) Len() int { return 0 }
+
+// NewPointer returns a new pointer type for the given element (base) type.
+func NewPointer(elem Type) *Pointer { return nil }
+
+// Elem returns the element type for the given pointer.
+func (*Pointer) Elem() Type { return nil }
+
+func (*Struct) NumFields() int { return 0 }
+
+func (*Struct) Field(i int) *Var { return nil }
+
+type Var struct{}
+
+func (*Var) Embedded() bool { return false }
+
+func (*Var) Type() Type { return nil }
diff --git a/vendor/golang.org/x/sync/LICENSE b/vendor/golang.org/x/sync/LICENSE
index 6a66aea..2a7cf70 100644
--- a/vendor/golang.org/x/sync/LICENSE
+++ b/vendor/golang.org/x/sync/LICENSE
@@ -1,4 +1,4 @@
-Copyright (c) 2009 The Go Authors. All rights reserved.
+Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -10,7 +10,7 @@ notice, this list of conditions and the following disclaimer.
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
-   * Neither the name of Google Inc. nor the names of its
+   * Neither the name of Google LLC nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 
diff --git a/vendor/golang.org/x/sync/semaphore/semaphore.go b/vendor/golang.org/x/sync/semaphore/semaphore.go
index 30f632c..b618162 100644
--- a/vendor/golang.org/x/sync/semaphore/semaphore.go
+++ b/vendor/golang.org/x/sync/semaphore/semaphore.go
@@ -35,11 +35,25 @@ type Weighted struct {
 // Acquire acquires the semaphore with a weight of n, blocking until resources
 // are available or ctx is done. On success, returns nil. On failure, returns
 // ctx.Err() and leaves the semaphore unchanged.
-//
-// If ctx is already done, Acquire may still succeed without blocking.
 func (s *Weighted) Acquire(ctx context.Context, n int64) error {
+	done := ctx.Done()
+
 	s.mu.Lock()
+	select {
+	case <-done:
+		// ctx becoming done has "happened before" acquiring the semaphore,
+		// whether it became done before the call began or while we were
+		// waiting for the mutex. We prefer to fail even if we could acquire
+		// the mutex without blocking.
+		s.mu.Unlock()
+		return ctx.Err()
+	default:
+	}
 	if s.size-s.cur >= n && s.waiters.Len() == 0 {
+		// Since we hold s.mu and haven't synchronized since checking done, if
+		// ctx becomes done before we return here, it becoming done must have
+		// "happened concurrently" with this call - it cannot "happen before"
+		// we return in this branch. So, we're ok to always acquire here.
 		s.cur += n
 		s.mu.Unlock()
 		return nil
@@ -48,7 +62,7 @@ func (s *Weighted) Acquire(ctx context.Context, n int64) error {
 	if n > s.size {
 		// Don't make other Acquire calls block on one that's doomed to fail.
 		s.mu.Unlock()
-		<-ctx.Done()
+		<-done
 		return ctx.Err()
 	}
 
@@ -58,14 +72,14 @@ func (s *Weighted) Acquire(ctx context.Context, n int64) error {
 	s.mu.Unlock()
 
 	select {
-	case <-ctx.Done():
-		err := ctx.Err()
+	case <-done:
 		s.mu.Lock()
 		select {
 		case <-ready:
-			// Acquired the semaphore after we were canceled.  Rather than trying to
-			// fix up the queue, just pretend we didn't notice the cancelation.
-			err = nil
+			// Acquired the semaphore after we were canceled.
+			// Pretend we didn't and put the tokens back.
+			s.cur -= n
+			s.notifyWaiters()
 		default:
 			isFront := s.waiters.Front() == elem
 			s.waiters.Remove(elem)
@@ -75,9 +89,19 @@ func (s *Weighted) Acquire(ctx context.Context, n int64) error {
 			}
 		}
 		s.mu.Unlock()
-		return err
+		return ctx.Err()
 
 	case <-ready:
+		// Acquired the semaphore. Check that ctx isn't already done.
+		// We check the done channel instead of calling ctx.Err because we
+		// already have the channel, and ctx.Err is O(n) with the nesting
+		// depth of ctx.
+		select {
+		case <-done:
+			s.Release(n)
+			return ctx.Err()
+		default:
+		}
 		return nil
 	}
 }
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 54bfc93..6c7344a 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -196,6 +196,9 @@ github.com/doug-martin/goqu/v9/sqlgen
 # github.com/dustin/go-humanize v1.0.1
 ## explicit; go 1.16
 github.com/dustin/go-humanize
+# github.com/ennyjfrick/ruleguard-logfatal v0.0.2
+## explicit; go 1.23
+github.com/ennyjfrick/ruleguard-logfatal
 # github.com/envoyproxy/protoc-gen-validate v1.0.4
 ## explicit; go 1.19
 github.com/envoyproxy/protoc-gen-validate/validate
@@ -290,6 +293,10 @@ github.com/power-devops/perfstat
 # github.com/pquerna/xjwt v0.2.0
 ## explicit; go 1.20
 github.com/pquerna/xjwt
+# github.com/quasilyte/go-ruleguard/dsl v0.3.22
+## explicit; go 1.15
+github.com/quasilyte/go-ruleguard/dsl
+github.com/quasilyte/go-ruleguard/dsl/types
 # github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec
 ## explicit; go 1.12
 github.com/remyoudompheng/bigfft
@@ -413,7 +420,7 @@ golang.org/x/oauth2/clientcredentials
 golang.org/x/oauth2/internal
 golang.org/x/oauth2/jws
 golang.org/x/oauth2/jwt
-# golang.org/x/sync v0.6.0
+# golang.org/x/sync v0.11.0
 ## explicit; go 1.18
 golang.org/x/sync/semaphore
 # golang.org/x/sys v0.18.0