测试代码质量 25→0：assert↔require 一致性（fail-fast）、float 精确比较→InDelta、Equal("",x)→Empty、Equal(len)→Len、errors.Is/As→ErrorIs/ErrorAs、JSON 字符串→JSONEq、handler goroutine 内 require→assert（真健壮性修复）、t.Helper()、os.MkdirTemp→t.TempDir()（符合 repo AGENTS 约束）。

Result: {"status":"keep","total_issues":8,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":8,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_usetesting":0,"golint_test_total":0,"eslint_problems":0,"eslint_errors":0,"eslint_warnings":0,"tsc_errors":0,"measure_s":39}

internal/apps/admin/logs/utils_test.go

@@ -16,6 +16,7 @@ import (
 )
 
 func setupTestDB(t *testing.T) *gorm.DB {
+	t.Helper()
 	dbConn, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{})
 	if err != nil {
 		t.Fatalf("failed to open sqlite in memory: %v", err)

internal/apps/admin/push/push_test.go

@@ -65,6 +65,7 @@ func (m *mockPusher) ValidateConfig(cfg pkgpush.Config) error {
 }
 
 func setupPushTest(t *testing.T) (*gorm.DB, *miniredis.Miniredis, func()) {
+	t.Helper()
 	dbConn, mr, cleanup := testhelper.SetupTestEnvironment(t)
 
 	// AutoMigrate push tables in SQLite test environment
@@ -319,7 +320,7 @@ func TestPushHandler(t *testing.T) {
 		assert.Equal(t, "Structured Alert", mPusher.sentBody["title"])
 		assert.Equal(t, "Hello World", mPusher.sentBody["content"])
 		assert.Equal(t, "WARNING", mPusher.sentBody["level"])
-		assert.Equal(t, float64(42), mPusher.sentBody["extra_val"]) // unmarshaled json numbers are float64 by default
+		assert.InDelta(t, float64(42), mPusher.sentBody["extra_val"], 1e-9) // unmarshaled json numbers are float64 by default
 		mPusher.mu.Unlock()
 
 		// Verify PushHistory recorded
@@ -436,7 +437,7 @@ func TestPushRouters(t *testing.T) {
 
 		dataMap, ok := resp.Data.(map[string]any)
 		assert.True(t, ok)
-		assert.Equal(t, float64(1), dataMap["total"])
+		assert.InDelta(t, float64(1), dataMap["total"], 1e-9)
 	})
 
 	t.Run("test push endpoint", func(t *testing.T) {
@@ -614,37 +615,37 @@ func TestPushChannelAPI(t *testing.T) {
 	t.Run("validate push channel model constraints", func(t *testing.T) {
 		// 校验名称合法性
 		c1 := &model.PushChannel{Name: "invalid-name!", URL: "https://hook.com", Other: "{}"}
-		assert.Error(t, c1.Validate())
+		require.Error(t, c1.Validate())
 
 		// 校验 URL 安全前缀 HTTPS
 		c2 := &model.PushChannel{Name: "custom_channel", URL: "http://insecure-hook.com", Other: "{}"}
-		assert.Error(t, c2.Validate())
+		require.Error(t, c2.Validate())
 
 		// 校验 JSON 格式
 		c3 := &model.PushChannel{Name: "custom_channel", URL: "https://hook.com", Other: "{invalid-json}"}
-		assert.Error(t, c3.Validate())
+		require.Error(t, c3.Validate())
 
 		// 正确配置
 		c4 := &model.PushChannel{Name: "custom_channel", URL: "https://hook.com", Other: "{\"content\":\"$content\"}"}
-		assert.NoError(t, c4.Validate())
+		require.NoError(t, c4.Validate())
 
 		// 飞书渠道校验：非 HTTPS 地址报错
 		c5 := &model.PushChannel{Name: "lark_channel", Type: "lark", URL: "http://open.feishu.cn", Other: ""}
-		assert.Error(t, c5.Validate())
+		require.Error(t, c5.Validate())
 
 		// 飞书正确配置
 		c6 := &model.PushChannel{Name: "lark_channel", Type: "lark", URL: "https://open.feishu.cn", Other: ""}
-		assert.NoError(t, c6.Validate())
+		require.NoError(t, c6.Validate())
 
 		// Telegram 渠道校验
 		cTelegramErr := &model.PushChannel{Name: "tg_channel", Type: "telegram", URL: "https://api.telegram.org", Token: "", Other: ""}
-		assert.Error(t, cTelegramErr.Validate())
+		require.Error(t, cTelegramErr.Validate())
 
 		cTelegramErr2 := &model.PushChannel{Name: "tg_channel", Type: "telegram", URL: "http://api.telegram.org", Token: "123:abc", Other: ""}
-		assert.Error(t, cTelegramErr2.Validate())
+		require.Error(t, cTelegramErr2.Validate())
 
 		cTelegramOk := &model.PushChannel{Name: "tg_channel", Type: "telegram", URL: "", Token: "123:abc", Other: "-100123"}
-		assert.NoError(t, cTelegramOk.Validate())
+		require.NoError(t, cTelegramOk.Validate())
 		assert.Equal(t, "https://api.telegram.org", cTelegramOk.URL)
 
 		// 邮件配置校验：允许空配置以复用系统全局设置
@@ -733,7 +734,7 @@ func TestPushChannelAPI(t *testing.T) {
 		dbConn.First(&updated, createdID)
 		assert.Equal(t, "Updated remark", updated.Description)
 		assert.Equal(t, "new_chan_token", updated.Token)
-		assert.Equal(t, `{"text": "$content"}`, updated.Other)
+		assert.JSONEq(t, `{"text": "$content"}`, updated.Other)
 	})
 
 	t.Run("admin test channel endpoint", func(t *testing.T) {

internal/apps/admin/task/routers_test.go

@@ -46,6 +46,7 @@ func registerInternalOnlyTaskMeta() {
 }
 
 func setupTaskTestEnvironment(t *testing.T) func() {
+	t.Helper()
 	_, mr, cleanup := testhelper.SetupTestEnvironment(t)
 	bootstrap.RegisterTasks()
 	task.AsynqClient = asynq.NewClient(asynq.RedisClientOpt{
@@ -490,7 +491,7 @@ func TestListTaskExecutions(t *testing.T) {
 		var data map[string]interface{}
 		json.Unmarshal(dataBytes, &data)
 
-		assert.Equal(t, float64(3), data["total"])
+		assert.InDelta(t, float64(3), data["total"], 1e-9)
 	})
 
 	t.Run("filter by status", func(t *testing.T) {
@@ -507,7 +508,7 @@ func TestListTaskExecutions(t *testing.T) {
 		var data map[string]interface{}
 		json.Unmarshal(dataBytes, &data)
 
-		assert.Equal(t, float64(1), data["total"])
+		assert.InDelta(t, float64(1), data["total"], 1e-9)
 	})
 
 	t.Run("filter by task_type (asynq task name)", func(t *testing.T) {
@@ -524,7 +525,7 @@ func TestListTaskExecutions(t *testing.T) {
 		var data map[string]interface{}
 		json.Unmarshal(dataBytes, &data)
 
-		assert.Equal(t, float64(3), data["total"])
+		assert.InDelta(t, float64(3), data["total"], 1e-9)
 	})
 
 	t.Run("filter by task_type (management task type)", func(t *testing.T) {
@@ -541,7 +542,7 @@ func TestListTaskExecutions(t *testing.T) {
 		var data map[string]interface{}
 		json.Unmarshal(dataBytes, &data)
 
-		assert.Equal(t, float64(3), data["total"])
+		assert.InDelta(t, float64(3), data["total"], 1e-9)
 	})
 
 	t.Run("pagination", func(t *testing.T) {
@@ -558,7 +559,7 @@ func TestListTaskExecutions(t *testing.T) {
 		var data map[string]interface{}
 		json.Unmarshal(dataBytes, &data)
 
-		assert.Equal(t, float64(3), data["total"])
+		assert.InDelta(t, float64(3), data["total"], 1e-9)
 	})
 }
 

internal/apps/agent/sync/pages_stream_test.go

@@ -238,10 +238,7 @@ func TestPromoteSameHashReleaseFailureRestoresPreviousCurrent(t *testing.T) {
 	if err := switchPagesProjectCurrentDir(pagesDir, projectID, releaseDir); err != nil {
 		t.Fatalf("seed same-hash current error = %v", err)
 	}
-	stagingDir, err := os.MkdirTemp(filepath.Dir(releaseDir), ".same-hash-*.tmp")
-	if err != nil {
-		t.Fatalf("create same-hash staging error = %v", err)
-	}
+	stagingDir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(stagingDir, "index.html"), []byte("new"), pagesFilePerm); err != nil {
 		t.Fatalf("write repaired same-hash release error = %v", err)
 	}
@@ -249,7 +246,7 @@ func TestPromoteSameHashReleaseFailureRestoresPreviousCurrent(t *testing.T) {
 		t.Fatalf("write repaired same-hash marker error = %v", err)
 	}
 	copyErr := errors.New("injected same-hash copy failure")
-	err = promotePagesReleaseWithCopy(
+	err := promotePagesReleaseWithCopy(
 		stagingDir,
 		releaseDir,
 		project,
@@ -298,10 +295,7 @@ func TestPromotePagesReleaseRepairsDanglingCurrent(t *testing.T) {
 	}
 
 	requireTestMkdirAll(t, filepath.Dir(releaseDir))
-	stagingDir, err := os.MkdirTemp(filepath.Dir(releaseDir), ".dangling-*.tmp")
-	if err != nil {
-		t.Fatalf("create dangling repair staging error = %v", err)
-	}
+	stagingDir := t.TempDir()
 	if err := os.WriteFile(filepath.Join(stagingDir, "index.html"), []byte("repaired"), pagesFilePerm); err != nil {
 		t.Fatalf("write dangling repair staging error = %v", err)
 	}

internal/apps/flared/frpc/manager_test.go

@@ -16,6 +16,7 @@ import (
 
 // Helper to write control file for the dummy script
 func writeControl(t *testing.T, dir string, exitCode int, delaySeconds int) {
+	t.Helper()
 	controlPath := filepath.Join(dir, "control.txt")
 	content := fmt.Sprintf("%d %d\n", exitCode, delaySeconds)
 	err := os.WriteFile(controlPath, []byte(content), 0644)
@@ -26,6 +27,7 @@ func writeControl(t *testing.T, dir string, exitCode int, delaySeconds int) {
 
 // Setup a dummy executable script that reads control.txt to decide exit code and sleep duration
 func setupDummyScript(t *testing.T) (string, string) {
+	t.Helper()
 	dir := t.TempDir()
 	scriptPath := filepath.Join(dir, "dummy_frpc")
 
@@ -53,6 +55,7 @@ exit "${EXIT_CODE:-0}"
 
 // Helper to poll for status to eliminate timing flakiness in tests
 func assertStatusEventually(t *testing.T, m *Manager, relayID string, expectedStatus string, timeout time.Duration) {
+	t.Helper()
 	deadline := time.Now().Add(timeout)
 	for time.Now().Before(deadline) {
 		m.mu.RLock()

internal/apps/oauth/oauth_test.go

@@ -336,6 +336,7 @@ func newMockOIDCClient(issuer, clientID string, expectedState *string, sub, user
 }
 
 func setupTestDB(t *testing.T) *gorm.DB {
+	t.Helper()
 	repository.ResetSystemConfigRAMCacheForTest()
 	repository.ResetAuthSourceRAMCacheForTest()
 

internal/apps/openflare/apply_log/logics_test.go

@@ -19,6 +19,7 @@ import (
 )
 
 func setupApplyLogTestDB(t *testing.T) func() {
+	t.Helper()
 	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
 		DisableForeignKeyConstraintWhenMigrating: true,
 	})

internal/apps/openflare/config_version/certificate_snapshot_test.go

@@ -94,6 +94,7 @@ func TestBuildSnapshotReadsZoneDomainCertificates(t *testing.T) {
 }
 
 func generateTestCertKeyPairForSnapshot(t *testing.T) (certPEM string, keyPEM string) {
+	t.Helper()
 	return generateTestCertKeyPairForSnapshotForDomain(t, "test.example.com")
 }
 

internal/apps/openflare/config_version/origin_error_page_snapshot_test.go

@@ -98,7 +98,7 @@ func TestDiffOpenRestyOptionDetailsOriginErrorPage(t *testing.T) {
 	assert.Equal(t, "false", keys["OriginErrorPageEnabled"].CurrentValue)
 	assert.Equal(t, `["500-599"]`, keys["OriginErrorPageStatusCodes"].PreviousValue)
 	assert.Equal(t, `["522"]`, keys["OriginErrorPageStatusCodes"].CurrentValue)
-	assert.Equal(t, "", keys["OriginErrorPageHTML"].PreviousValue)
+	assert.Empty(t, keys["OriginErrorPageHTML"].PreviousValue)
 	assert.Equal(t, "<p>x</p>", keys["OriginErrorPageHTML"].CurrentValue)
 }
 

internal/apps/openflare/dashboard/logics_test.go

@@ -20,6 +20,7 @@ import (
 )
 
 func setupDashboardTestDB(t *testing.T) func() {
+	t.Helper()
 	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
 		DisableForeignKeyConstraintWhenMigrating: true,
 	})
@@ -124,8 +125,8 @@ func TestGetOverviewStructure(t *testing.T) {
 	onlineNodeCheck := overview.Nodes
 	require.NotEmpty(t, onlineNodeCheck)
 
-	assert.Equal(t, 55.0, overview.Capacity.AverageCPUUsagePercent)
-	assert.Equal(t, 50.0, overview.Capacity.AverageMemoryUsagePercent)
+	assert.InDelta(t, 55.0, overview.Capacity.AverageCPUUsagePercent, 1e-9)
+	assert.InDelta(t, 50.0, overview.Capacity.AverageMemoryUsagePercent, 1e-9)
 	assert.Equal(t, 0, overview.Capacity.HighCPUNodes)
 	assert.Equal(t, 0, overview.Capacity.HighMemoryNodes)
 	assert.Equal(t, 0, overview.Capacity.HighStorageNodes)
@@ -171,11 +172,11 @@ func TestGetOverviewStructure(t *testing.T) {
 	assert.Equal(t, "online", onlineNode[6])
 	assert.Equal(t, "healthy", onlineNode[7])
 	// Latest-per-node health fields (indexes match compressDashboardNodes).
-	assert.Equal(t, 55.0, onlineNode[11])      // cpu_usage_percent from latest snapshot
-	assert.Equal(t, 50.0, onlineNode[12])      // memory_usage_percent
-	assert.Equal(t, int64(12), onlineNode[14]) // request_count from access logs
-	assert.Equal(t, int64(1), onlineNode[15])  // error_count
-	assert.Equal(t, int64(4), onlineNode[16])  // unique visitors
+	assert.InDelta(t, 55.0, onlineNode[11], 1e-9) // cpu_usage_percent from latest snapshot
+	assert.InDelta(t, 50.0, onlineNode[12], 1e-9) // memory_usage_percent
+	assert.Equal(t, int64(12), onlineNode[14])    // request_count from access logs
+	assert.Equal(t, int64(1), onlineNode[15])     // error_count
+	assert.Equal(t, int64(4), onlineNode[16])     // unique visitors
 
 	pendingNode := nodeByID["node-dashboard-2"]
 	require.NotNil(t, pendingNode)
@@ -183,6 +184,6 @@ func TestGetOverviewStructure(t *testing.T) {
 	assert.Equal(t, "pending", pendingNode[6])
 	assert.Equal(t, "unknown", pendingNode[7])
 
-	assert.Equal(t, 55.0, overview.Capacity.AverageCPUUsagePercent)
+	assert.InDelta(t, 55.0, overview.Capacity.AverageCPUUsagePercent, 1e-9)
 	assert.Equal(t, 1, overview.Traffic.ReportedNodes)
 }

internal/apps/openflare/integration/core_chain_test.go

@@ -171,7 +171,7 @@ func TestCoreChainMigrationFlow(t *testing.T) {
 		zoneDomains := data["zone_domains"].([]any)
 		assert.Len(t, zoneDomains, 1)
 		assert.Equal(t, "core-chain.example.com", zoneDomains[0].(map[string]any)["domain"])
-		assert.Equal(t, float64(originID), data["origin_id"])
+		assert.InDelta(t, float64(originID), data["origin_id"], 1e-9)
 		assert.Equal(t, "http://origin.core-chain.internal:8080", data["origin_url"])
 	})
 
@@ -257,7 +257,7 @@ func TestCoreChainMigrationFlow(t *testing.T) {
 
 		listResp := requireAPIOK(t, listRec)
 		listData := unmarshalAPIMap(t, listResp.Data)
-		assert.Equal(t, float64(1), listData["total"])
+		assert.InDelta(t, float64(1), listData["total"], 1e-9)
 
 		rows, ok := listData["rows"].([]any)
 		require.True(t, ok)
@@ -278,10 +278,10 @@ func TestCoreChainMigrationFlow(t *testing.T) {
 		require.Len(t, nodes, 1)
 		nodeView, ok := nodes[0].(map[string]any)
 		require.True(t, ok)
-		assert.Equal(t, float64(nodeID), nodeView["id"])
+		assert.InDelta(t, float64(nodeID), nodeView["id"], 1e-9)
 		assert.Equal(t, nodePublicID, nodeView["node_id"])
 		assert.Equal(t, "success", nodeView["latest_apply_result"])
 		assert.Equal(t, configChecksum, nodeView["latest_apply_checksum"])
-		assert.Equal(t, float64(2), nodeView["latest_support_file_count"])
+		assert.InDelta(t, float64(2), nodeView["latest_support_file_count"], 1e-9)
 	})
 }

internal/apps/openflare/integration/security_test.go

@@ -119,7 +119,7 @@ func TestSecurityWAFTLSMigrationFlow(t *testing.T) {
 		assert.NotZero(t, ruleGroupID)
 		assert.Equal(t, "edge-security", data["name"])
 		assert.Equal(t, false, data["is_global"])
-		assert.Equal(t, float64(1), data["revision"])
+		assert.InDelta(t, float64(1), data["revision"], 1e-9)
 		assert.NotNil(t, data["graph"])
 	})
 
@@ -161,7 +161,7 @@ func TestSecurityWAFTLSMigrationFlow(t *testing.T) {
 
 		resp := requireAPIOK(t, rec)
 		data := unmarshalAPIMap(t, resp.Data)
-		assert.Equal(t, float64(ruleGroupID), data["id"])
+		assert.InDelta(t, float64(ruleGroupID), data["id"], 1e-9)
 		assert.Equal(t, "edge-security", data["name"])
 	})
 
@@ -244,12 +244,12 @@ func TestSecurityWAFTLSMigrationFlow(t *testing.T) {
 
 		resp := requireAPIOK(t, rec)
 		data := unmarshalAPIMap(t, resp.Data)
-		assert.Equal(t, float64(proxyRouteID), data["route_id"])
+		assert.InDelta(t, float64(proxyRouteID), data["route_id"], 1e-9)
 
 		appliedIDs, ok := data["applied_ids"].([]any)
 		require.True(t, ok)
 		require.Len(t, appliedIDs, 1)
-		assert.Equal(t, float64(ruleGroupID), appliedIDs[0])
+		assert.InDelta(t, float64(ruleGroupID), appliedIDs[0], 1e-9)
 	})
 
 	t.Run("verify site rule groups binding", func(t *testing.T) {
@@ -272,7 +272,7 @@ func TestSecurityWAFTLSMigrationFlow(t *testing.T) {
 		require.Len(t, appliedGroups, 1)
 		group, ok := appliedGroups[0].(map[string]any)
 		require.True(t, ok)
-		assert.Equal(t, float64(ruleGroupID), group["id"])
+		assert.InDelta(t, float64(ruleGroupID), group["id"], 1e-9)
 	})
 
 	t.Run("create TLS certificate with PEM", func(t *testing.T) {
@@ -319,7 +319,7 @@ func TestSecurityWAFTLSMigrationFlow(t *testing.T) {
 		domainID = uint(data["id"].(float64))
 		assert.NotZero(t, domainID)
 		assert.Equal(t, "security.example.com", data["domain"])
-		assert.Equal(t, float64(certID), data["cert_id"])
+		assert.InDelta(t, float64(certID), data["cert_id"], 1e-9)
 	})
 
 	t.Run("create DNS account", func(t *testing.T) {

internal/apps/openflare/proxy_route/logics_test.go

@@ -136,7 +136,7 @@ func TestRouteCanMoveAwayFromAlreadyMissingPagesProject(t *testing.T) {
 }
 
 func TestNormalizeCachePolicyDefaultsAndLegacy(t *testing.T) {
-	assert.Equal(t, "", normalizeCachePolicy(false, "static"))
+	assert.Empty(t, normalizeCachePolicy(false, "static"))
 	// Empty/url on write = legacy all (compat); UI sends static explicitly for new default.
 	assert.Equal(t, proxyRouteCachePolicyAll, normalizeCachePolicy(true, ""))
 	assert.Equal(t, proxyRouteCachePolicyStatic, normalizeCachePolicy(true, "static"))
@@ -144,7 +144,7 @@ func TestNormalizeCachePolicyDefaultsAndLegacy(t *testing.T) {
 	assert.Equal(t, proxyRouteCachePolicyAll, normalizeCachePolicy(true, "all"))
 	assert.Equal(t, proxyRouteCachePolicySuffix, normalizeCachePolicy(true, "suffix"))
 
-	assert.Equal(t, "", displayCachePolicy(false, "all"))
+	assert.Empty(t, displayCachePolicy(false, "all"))
 	assert.Equal(t, proxyRouteCachePolicyAll, displayCachePolicy(true, ""))
 	assert.Equal(t, proxyRouteCachePolicyAll, displayCachePolicy(true, "url"))
 	assert.Equal(t, proxyRouteCachePolicyStatic, displayCachePolicy(true, "static"))

internal/apps/openflare/relay/logics_test.go

@@ -117,7 +117,7 @@ func TestHeartbeatPayloadBindingAndFrpsObservationInsert(t *testing.T) {
 	snapshots, err := repository.ListOpenFlareMetricSnapshotsSince(ctx, node.NodeID, now.Add(-time.Minute), 10)
 	require.NoError(t, err)
 	require.Len(t, snapshots, 1)
-	assert.Equal(t, 12.5, snapshots[0].CPUUsagePercent)
+	assert.InDelta(t, 12.5, snapshots[0].CPUUsagePercent, 1e-9)
 
 	frpsObs, err := repository.ListOpenFlareNodeObservationFrps(ctx, node.NodeID, time.Time{}, 1)
 	require.NoError(t, err)

internal/apps/openflare/tls/acme_obtain_test.go

@@ -5,7 +5,6 @@ package tls
 
 import (
 	"context"
-	"strings"
 	"testing"
 	"time"
 
@@ -126,7 +125,7 @@ func TestConvertCertificateToACMEPreservesUploadOnFailure(t *testing.T) {
 	assert.Equal(t, "error", finalCert.ApplyStatus)
 	assert.Equal(t, originalStoredCertPEM, finalCert.CertPEM)
 	assert.Equal(t, originalStoredKeyPEM, finalCert.KeyPEM)
-	assert.True(t, strings.Contains(finalCert.ApplyMessage, "dns challenge failed"))
+	assert.Contains(t, finalCert.ApplyMessage, "dns challenge failed")
 }
 
 func TestConvertCertificateToACMERejectsInvalidStates(t *testing.T) {

internal/apps/openflare/waf/rule_logics_test.go

@@ -7,7 +7,6 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
-	"errors"
 	"net/http"
 	"net/http/httptest"
 	"strconv"
@@ -63,12 +62,14 @@ func TestRuleHandlersMapFailures(t *testing.T) {
 		{name: "invalid id", method: http.MethodGet, path: "/rules/nope", setup: setupWAFTestDB, want: http.StatusBadRequest},
 		{name: "malformed json", method: http.MethodPost, path: "/rules", body: `{`, setup: setupWAFTestDB, want: http.StatusBadRequest},
 		{name: "invalid graph", method: http.MethodPost, path: "/rules/1/graph", body: `{"revision":1,"graph":{"schema_version":1,"nodes":[],"edges":[]}}`, setup: func(t *testing.T) func() {
+			t.Helper()
 			cleanup := setupWAFTestDB(t)
 			_, err := CreateRule(context.Background(), CreateRuleInput{Name: "one"})
 			require.NoError(t, err)
 			return cleanup
 		}, want: http.StatusBadRequest},
 		{name: "manual IP group sync", method: http.MethodPost, path: "/ip-groups/1/sync", setup: func(t *testing.T) func() {
+			t.Helper()
 			cleanup := setupWAFTestDB(t)
 			_, err := CreateIPGroup(context.Background(), IPGroupInput{Name: "manual", Type: wafIPGroupTypeManual, Enabled: true})
 			require.NoError(t, err)
@@ -76,12 +77,13 @@ func TestRuleHandlersMapFailures(t *testing.T) {
 		}, want: http.StatusBadRequest},
 		{name: "missing", method: http.MethodGet, path: "/rules/999", setup: setupWAFTestDB, want: http.StatusNotFound},
 		{name: "conflict", method: http.MethodPost, path: "/rules/1/graph", body: mustGraphRequest(t, 0), setup: func(t *testing.T) func() {
+			t.Helper()
 			cleanup := setupWAFTestDB(t)
 			_, err := CreateRule(context.Background(), CreateRuleInput{Name: "one"})
 			require.NoError(t, err)
 			return cleanup
 		}, want: http.StatusConflict},
-		{name: "database failure", method: http.MethodGet, path: "/rules", setup: func(t *testing.T) func() { db.SetDB(nil); return func() {} }, want: http.StatusInternalServerError},
+		{name: "database failure", method: http.MethodGet, path: "/rules", setup: func(t *testing.T) func() { t.Helper(); db.SetDB(nil); return func() {} }, want: http.StatusInternalServerError},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -171,7 +173,7 @@ func TestReplaceSiteRuleGroupsPreservesOrderAndRejectsGlobal(t *testing.T) {
 	require.NoError(t, err)
 	_, err = ReplaceSiteRuleGroups(ctx, 7, []uint{global.ID, second.ID})
 	require.Error(t, err)
-	assert.False(t, errors.Is(err, model.ErrWAFRuleRevisionConflict))
+	require.NotErrorIs(t, err, model.ErrWAFRuleRevisionConflict)
 	assert.Equal(t, []uint{third.ID, first.ID, second.ID}, mustListSiteRuleGroupIDs(t, ctx, 7))
 }
 

internal/apps/relay/frps/manager_test.go

@@ -16,6 +16,7 @@ import (
 
 // Helper to write control file for the dummy script
 func writeControl(t *testing.T, dir string, exitCode int, delaySeconds int) {
+	t.Helper()
 	controlPath := filepath.Join(dir, "control.txt")
 	content := fmt.Sprintf("%d %d\n", exitCode, delaySeconds)
 	err := os.WriteFile(controlPath, []byte(content), 0644)
@@ -26,6 +27,7 @@ func writeControl(t *testing.T, dir string, exitCode int, delaySeconds int) {
 
 // Setup a dummy executable script that reads control.txt to decide exit code and sleep duration
 func setupDummyScript(t *testing.T) (string, string) {
+	t.Helper()
 	dir := t.TempDir()
 	scriptPath := filepath.Join(dir, "dummy_frps")
 
@@ -53,6 +55,7 @@ exit "${EXIT_CODE:-0}"
 
 // Helper to poll for status to eliminate timing flakiness in tests
 func assertStatusEventually(t *testing.T, m *Manager, expectedStatus string, timeout time.Duration) {
+	t.Helper()
 	if timeout < 6*time.Second {
 		timeout = 6 * time.Second
 	}

internal/apps/upload/filesrv/file_server_test.go

@@ -357,6 +357,7 @@ func TestNormalizeImageQuality(t *testing.T) {
 }
 
 func configureLocalStorageRoot(t *testing.T, dbConn *gorm.DB, tempDir string) {
+	t.Helper()
 	var sc model.SystemConfig
 	if err := dbConn.Where("key = ?", model.ConfigKeyStorageConfig).First(&sc).Error; err != nil {
 		t.Fatalf("failed to find storage config: %v", err)

internal/apps/upload/handler/routers_test.go

@@ -75,6 +75,7 @@ func setupTestRouter(authUser *model.User) *gin.Engine {
 }
 
 func createMultipartRequest(t *testing.T, fieldName, fileName string, fileContent []byte, extraFields map[string]string) (string, *bytes.Buffer) {
+	t.Helper()
 	body := &bytes.Buffer{}
 	writer := multipart.NewWriter(body)
 
@@ -1086,6 +1087,7 @@ func TestDeleteReservedUploadType(t *testing.T) {
 }
 
 func configureLocalStorageRoot(t *testing.T, dbConn *gorm.DB, tempDir string) {
+	t.Helper()
 	var sc model.SystemConfig
 	if err := dbConn.Where("key = ?", model.ConfigKeyStorageConfig).First(&sc).Error; err != nil {
 		t.Fatalf("failed to find storage config: %v", err)

internal/apps/upload/ingest/ingest_test.go

@@ -513,6 +513,7 @@ func loadTotalStats(ctx context.Context) (totalStatsSnapshot, error) {
 }
 
 func setupMockStorage(t *testing.T, putCount *int) (restore func(), disable func()) {
+	t.Helper()
 	return setupMockStorageWithDeleteCount(t, putCount, nil)
 }