forcetypeassert 6→0（缓存 list 断言、relay/flared 中间件契约断言、图片压缩 flight 断言，全部带检查+安全失败路径）；errname 1→0；prealloc 2 处（另 1 处与 repo mnd 冲突，用命名常量解决）。nilnil 保留（not-found/可选结果惯例，含接口契约注释）。

Result: {"status":"keep","total_issues":15,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":14,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":43}

internal/apps/openflare/flared/routers.go

@@ -37,7 +37,11 @@ func PostHeartbeat(c *gin.Context) {
 		response.AbortUnauthorized(c, errTunnelTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errTunnelTokenInvalid)
+		return
+	}
 
 	result, err := Heartbeat(c.Request.Context(), node, payload)
 	if apiutil.AbortBadRequestOnError(c, err) {
@@ -63,7 +67,11 @@ func GetActiveConfig(c *gin.Context) {
 		response.AbortUnauthorized(c, errTunnelTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errTunnelTokenInvalid)
+		return
+	}
 
 	config, err := GetTunnelConfig(c.Request.Context(), node)
 	if apiutil.AbortBadRequestOnError(c, err) {
@@ -91,7 +99,9 @@ func PostApplyLog(c *gin.Context) {
 		return
 	}
 	if authNode, ok := c.Get(ctxFlaredNodeKey); ok {
-		payload.NodeID = authNode.(*model.OpenFlareNode).NodeID
+		if node, ok := authNode.(*model.OpenFlareNode); ok {
+			payload.NodeID = node.NodeID
+		}
 	}
 
 	log, err := ReportApplyLog(c.Request.Context(), payload)
@@ -115,6 +125,10 @@ func GetWebSocket(c *gin.Context) {
 		response.AbortUnauthorized(c, errTunnelTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errTunnelTokenInvalid)
+		return
+	}
 	ofws.ServeFlared(c, node.NodeID)
 }

internal/apps/openflare/geoip/runtime.go

@@ -26,7 +26,7 @@ const (
 
 var (
 	runtimeOnce       sync.Once
-	runtimeInitErr    error
+	errRuntimeInit    error
 	currentProviderMu sync.RWMutex
 	currentProvider   string
 )
@@ -34,9 +34,9 @@ var (
 // EnsureRuntimeProvider loads GeoIP provider config from SystemConfig.
 func EnsureRuntimeProvider(ctx context.Context) error {
 	runtimeOnce.Do(func() {
-		runtimeInitErr = applyProviderFromSystemConfig(ctx)
+		errRuntimeInit = applyProviderFromSystemConfig(ctx)
 	})
-	return runtimeInitErr
+	return errRuntimeInit
 }
 
 // RefreshRuntimeProvider reapplies GeoIPProvider after config updates.
@@ -115,7 +115,7 @@ func ensureServerMMDB() (string, error) {
 // ResetRuntimeForTest clears lazy-init state for unit tests.
 func ResetRuntimeForTest() {
 	runtimeOnce = sync.Once{}
-	runtimeInitErr = nil
+	errRuntimeInit = nil
 	currentProviderMu.Lock()
 	currentProvider = ""
 	currentProviderMu.Unlock()

internal/apps/openflare/relay/routers.go

@@ -38,7 +38,11 @@ func PostHeartbeat(c *gin.Context) {
 		response.AbortUnauthorized(c, errAgentTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errAgentTokenInvalid)
+		return
+	}
 
 	result, err := Heartbeat(c.Request.Context(), node, payload)
 	if apiutil.AbortBadRequestOnError(c, err) {
@@ -61,6 +65,10 @@ func GetWebSocket(c *gin.Context) {
 		response.AbortUnauthorized(c, errAgentTokenInvalid)
 		return
 	}
-	node := authNode.(*model.OpenFlareNode)
+	node, ok := authNode.(*model.OpenFlareNode)
+	if !ok {
+		response.AbortUnauthorized(c, errAgentTokenInvalid)
+		return
+	}
 	ofws.ServeRelay(c, node.NodeID)
 }

internal/apps/openflare/uptimekuma/client.go

@@ -281,7 +281,8 @@ func (c *SocketIOClient) Emit(event string, args ...any) (string, error) {
 	c.ackChanMap[id] = ch
 	c.ackMutex.Unlock()
 
-	payloadArr := []any{event}
+	payloadArr := make([]any, 1, 1+len(args))
+	payloadArr[0] = event
 	payloadArr = append(payloadArr, args...)
 	bs, err := json.Marshal(payloadArr)
 	if err != nil {

internal/apps/upload/filesrv/file_server.go

@@ -206,7 +206,10 @@ func EnsureCompressedImageCache(
 		return nil, false, err
 	}
 
-	res := result.(compressedImageCacheResult)
+	res, ok := result.(compressedImageCacheResult)
+	if !ok {
+		return nil, false, fmt.Errorf("image compression flight returned unexpected type %T", result)
+	}
 	return res.bytes, res.cached, res.err
 }
 

internal/infra/persistence/postgres.go

@@ -21,6 +21,9 @@ import (
 	"gorm.io/plugin/opentelemetry/tracing"
 )
 
+// baseTracingOptionCount 是 newGORMTracingPlugin 预置的 tracing 选项数量。
+const baseTracingOptionCount = 3
+
 var (
 	db *gorm.DB
 )
@@ -106,7 +109,7 @@ func initPostgres() {
 	}
 
 	if len(dbConfig.Replicas) > 0 {
-		var replicaDialectors []gorm.Dialector
+		var replicaDialectors = make([]gorm.Dialector, 0, len(dbConfig.Replicas))
 		for _, replica := range dbConfig.Replicas {
 			username := replica.Username
 			if username == "" {
@@ -156,11 +159,12 @@ func initPostgres() {
 
 // newGORMTracingPlugin 构造数据库链路追踪插件。查询参数只保留占位符，避免凭据等绑定值进入 Span。
 func newGORMTracingPlugin(attrs []attribute.KeyValue, extraOptions ...tracing.Option) gorm.Plugin {
-	options := []tracing.Option{
+	options := make([]tracing.Option, 0, baseTracingOptionCount+len(extraOptions))
+	options = append(options,
 		tracing.WithoutMetrics(),
 		tracing.WithoutQueryVariables(),
 		tracing.WithAttributes(attrs...),
-	}
+	)
 	options = append(options, extraOptions...)
 	return tracing.NewPlugin(options...)
 }