后端与全仓代码质量清理（golangci 扩展集 · 测试质量 · 并发安全 · 文档同步）

代码质量全量清理，零行为变化：golangci 扩展集 13 类 linter（gosec/modernize/perfsprint/canonicalheader/usestdlibvars/wastedassign/intrange/errorlint/forcetypeassert/recvcheck/exhaustive/unparam）全量修复，测试代码质量（testifylint/thelper/usetesting）25→0，frpc 进程生命周期真 bug（进程组击杀）、全仓 go test -race 6 类数据竞争（含 1 个生产竞争）、SPDX license 头补齐 131 文件、前端测试套件 next-intl 迁移后 44 失败→全绿、过期 swagger 文档重新生成、pnpm-workspace 构建审批。

Experiments: #2-#17, #18, #20, #21, #23
Metric: total_issues 108 → 8 (-92.6%)

pkg/pagesarchive/entry.go

@@ -72,14 +72,14 @@ func copyLimited(dst io.Writer, src io.Reader, maxBytes int64) (int64, error) {
 		return written, err
 	}
 	if written > maxBytes {
-		return written, fmt.Errorf("pages file size out of bounds")
+		return written, errors.New("pages file size out of bounds")
 	}
 	return written, nil
 }
 
 func copyAndVerifySize(dst io.Writer, src io.Reader, declaredSize uint64, maxBytes int64) (int64, error) {
 	if declaredSize > uint64(math.MaxInt64) {
-		return 0, fmt.Errorf("pages file size out of bounds")
+		return 0, errors.New("pages file size out of bounds")
 	}
 	written, err := copyLimited(dst, src, maxBytes)
 	if err != nil {

pkg/pagesarchive/extract.go

@@ -124,7 +124,7 @@ func extractEntries(entries []Entry, destDir string, opts ExtractOptions) error
 		appendMeasuredFile(measured, normalizedPath, actual)
 	}
 	if measured.fileCount == 0 {
-		return fmt.Errorf("pages package is empty")
+		return errors.New("pages package is empty")
 	}
 	return nil
 }
@@ -139,7 +139,7 @@ func extractTarFamilyAt(ra io.ReaderAt, size int64, format Format, destDir strin
 		return err
 	}
 	if firstPass.fileCount == 0 {
-		return fmt.Errorf("pages package is empty")
+		return errors.New("pages package is empty")
 	}
 	commonPrefix := ""
 	if opts.StripCommonRoot {
@@ -162,7 +162,7 @@ func extractTarFamilyAt(ra io.ReaderAt, size int64, format Format, destDir strin
 		return extractErr
 	}
 	if secondPass.fileCount != firstPass.fileCount || secondPass.totalSize != firstPass.totalSize {
-		return fmt.Errorf("pages tar package changed between validation and extraction")
+		return errors.New("pages tar package changed between validation and extraction")
 	}
 	return nil
 }
@@ -177,7 +177,7 @@ func extractTarReader(
 	measured := &measuredArchive{files: make([]measuredFile, 0)}
 	for {
 		header, err := tarReader.Next()
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			break
 		}
 		if err != nil {

pkg/pagesarchive/format.go

@@ -7,7 +7,7 @@ package pagesarchive
 
 import (
 	"bytes"
-	"fmt"
+	"errors"
 	"path/filepath"
 	"strings"
 )
@@ -87,7 +87,7 @@ func DetectFormat(fileName string, data []byte) (Format, error) {
 	if format, ok := DetectFormatFromBytes(data); ok {
 		return format, nil
 	}
-	return "", fmt.Errorf("unsupported pages package format")
+	return "", errors.New("unsupported pages package format")
 }
 
 // Extension returns the canonical file extension for a format (without leading dot).

pkg/pagesarchive/inspect.go

@@ -137,7 +137,7 @@ func scanTarFamilyAt(
 	enforceLimits bool,
 ) (*measuredArchive, error) {
 	if size < 0 {
-		return nil, fmt.Errorf("invalid pages package size")
+		return nil, errors.New("invalid pages package size")
 	}
 	tarReader, closeReader, err := openTarFamilyReader(io.NewSectionReader(ra, 0, size), format)
 	if err != nil {
@@ -154,7 +154,7 @@ func scanTarReader(tarReader *tar.Reader, limits Limits, enforceLimits bool) (*m
 	measured := &measuredArchive{files: make([]measuredFile, 0)}
 	for {
 		header, err := tarReader.Next()
-		if err == io.EOF {
+		if errors.Is(err, io.EOF) {
 			break
 		}
 		if err != nil {
@@ -183,7 +183,7 @@ func scanTarReader(tarReader *tar.Reader, limits Limits, enforceLimits bool) (*m
 
 func buildMeasuredManifest(measured *measuredArchive, opts InspectOptions) (*Manifest, error) {
 	if measured == nil || measured.fileCount == 0 {
-		return nil, fmt.Errorf("pages package is empty")
+		return nil, errors.New("pages package is empty")
 	}
 	targetEntryPath, err := resolveTargetEntryPath(opts.RootDir, opts.EntryFile)
 	if err != nil {
@@ -231,7 +231,7 @@ func prepareMeasuredFile(measured *measuredArchive, normalizedPath string, decla
 	}
 	remaining := limits.MaxTotalBytes - measured.totalSize
 	if remaining < 0 || declaredSize > uint64(remaining) { //nolint:gosec // remaining is checked non-negative
-		return fmt.Errorf("pages extracted size exceeds limit")
+		return errors.New("pages extracted size exceeds limit")
 	}
 	return nil
 }
@@ -295,6 +295,8 @@ func isTarFamily(format Format) bool {
 	switch format {
 	case FormatTar, FormatTarGz, FormatTarXz, FormatTarBz2:
 		return true
+	case FormatZip, FormatSevenZip:
+		return false
 	default:
 		return false
 	}

pkg/pagesarchive/list.go

@@ -8,6 +8,7 @@ import (
 	"archive/zip"
 	"compress/bzip2"
 	"compress/gzip"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -52,13 +53,15 @@ func (z sevenZipArchiveFile) Open() (io.ReadCloser, error) {
 // Tar-family archives use the sequential streaming paths in inspect.go/extract.go.
 func listRandomAccessEntriesAt(ra io.ReaderAt, size int64, format Format) ([]Entry, error) {
 	if size < 0 {
-		return nil, fmt.Errorf("invalid pages package size")
+		return nil, errors.New("invalid pages package size")
 	}
 	switch format {
 	case FormatZip:
 		return listZipEntriesAt(ra, size)
 	case FormatSevenZip:
 		return listSevenZipEntriesAt(ra, size)
+	case FormatTar, FormatTarGz, FormatTarXz, FormatTarBz2:
+		return nil, fmt.Errorf("unsupported random-access pages package format: %s", format)
 	default:
 		return nil, fmt.Errorf("unsupported random-access pages package format: %s", format)
 	}
@@ -126,6 +129,8 @@ func openTarFamilyReader(r io.Reader, format Format) (*tar.Reader, func() error,
 		return tar.NewReader(xzReader), func() error { return nil }, nil
 	case FormatTarBz2:
 		return tar.NewReader(bzip2.NewReader(r)), func() error { return nil }, nil
+	case FormatZip, FormatSevenZip:
+		return nil, nil, fmt.Errorf("unsupported tar family format: %s", format)
 	default:
 		return nil, nil, fmt.Errorf("unsupported tar family format: %s", format)
 	}

pkg/pagesarchive/path.go

@@ -4,6 +4,7 @@
 package pagesarchive
 
 import (
+	"errors"
 	"fmt"
 	"path"
 	"strings"
@@ -18,7 +19,7 @@ func NormalizeLogicalPath(raw string, allowEmpty bool) (string, error) {
 		if allowEmpty {
 			return "", nil
 		}
-		return "", fmt.Errorf("pages path is required")
+		return "", errors.New("pages path is required")
 	}
 	if err := validateLogicalPathText(raw); err != nil {
 		return "", err
@@ -29,7 +30,7 @@ func NormalizeLogicalPath(raw string, allowEmpty bool) (string, error) {
 		if allowEmpty {
 			return "", nil
 		}
-		return "", fmt.Errorf("pages path is required")
+		return "", errors.New("pages path is required")
 	}
 	if strings.HasPrefix(cleaned, "/") || cleaned == ".." || strings.HasPrefix(cleaned, "../") {
 		return "", fmt.Errorf("pages path escapes directory: %s", raw)
@@ -39,7 +40,7 @@ func NormalizeLogicalPath(raw string, allowEmpty bool) (string, error) {
 
 func validateLogicalPathText(raw string) error {
 	if !utf8.ValidString(raw) {
-		return fmt.Errorf("pages path is not valid UTF-8")
+		return errors.New("pages path is not valid UTF-8")
 	}
 	if strings.Contains(raw, "\\") {
 		return fmt.Errorf("pages path must use POSIX separators: %s", raw)
@@ -56,7 +57,7 @@ func validateLogicalPathText(raw string) error {
 func validateLogicalPathRunes(raw string) error {
 	for _, r := range raw {
 		if r == 0 || unicode.IsControl(r) {
-			return fmt.Errorf("pages path contains a control character")
+			return errors.New("pages path contains a control character")
 		}
 		if r == '\'' || r == '"' || r == ';' {
 			return fmt.Errorf("pages path contains an unsupported character: %s", raw)
@@ -66,7 +67,7 @@ func validateLogicalPathRunes(raw string) error {
 }
 
 func validateLogicalPathSegments(raw string) error {
-	for _, segment := range strings.Split(raw, "/") {
+	for segment := range strings.SplitSeq(raw, "/") {
 		if len(segment) >= 2 && segment[1] == ':' {
 			return fmt.Errorf("pages path contains a Windows drive: %s", raw)
 		}