canonicalheader 8→0 + usestdlibvars 3→0：header key 改为 Go 规范大小写（wire 格式本就如此，纯代码修正）、HTTP 方法常量替代字符串字面量。

Result: {"status":"keep","total_issues":45,"golint_canonicalheader":0,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":5,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":0,"golint_wastedassign":7,"golint_total":44,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":38}

.auto/log.jsonl

@@ -2,3 +2,4 @@
 {"run":1,"commit":"305d609","metric":108,"metrics":{"golint_canonicalheader":8,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":2,"golint_intrange":3,"golint_modernize":37,"golint_nilnil":3,"golint_perfsprint":18,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":3,"golint_wastedassign":7,"golint_total":107,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":36},"status":"checks_failed","description":"基线：总问题 108（golangci 107 + eslint 1）。checks 失败的唯一原因：repo 自带 golangci gate 有 2 个既有 gosec G115 问题（预期内，首次修复后即绿）。","timestamp":1786871594292,"segment":0,"confidence":null,"asi":{"hypothesis":"baseline","next_action_hint":"修复 internal/apps/edge/observability/linux.go 的 2 个 G115 gosec 问题后 checks.sh 才能通过；之后每次迭代即可正常 keep/discard"}}
 {"run":2,"commit":"f1f6bb8","metric":106,"metrics":{"golint_canonicalheader":8,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":37,"golint_nilnil":3,"golint_perfsprint":18,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":3,"golint_wastedassign":7,"golint_total":105,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":38},"status":"keep","description":"修复 internal/apps/edge/observability/linux.go 的 2 个 gosec G115 整数溢出转换：helper 改为接收 int64 b，用 gosec 认可的饱和乘法模式（uint64 域乘积 + 上界比较），去掉原 //nolint:gosec，语义不变（Bsize 恒为正）。repo 自带 gate 首次全绿。","timestamp":1786872064145,"segment":0,"confidence":null,"asi":{"hypothesis":"修复 gosec G115：multiplyUint64ToInt64 改为 accept int64 b 并采用 gosec 认可的饱和乘法模式","insight":"gosec G115 不接受分支上界证明（a > MaxInt64/b），但接受先算 uint64 乘积再 if v > MaxInt64 饱和的模式，无需 nolint","next_action_hint":"下一步批量清理 modernize(37)/perfsprint(18) 等自动可修复类别，用 golangci-lint --fix 后人工核对 diff"}}
 {"run":3,"commit":"b76f707","metric":74,"metrics":{"golint_canonicalheader":8,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":5,"golint_nilnil":3,"golint_perfsprint":18,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":3,"golint_wastedassign":7,"golint_total":73,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":38},"status":"keep","description":"modernize 37→5（-32）：interface{}→any、内置 max/min、slices/maps 辅助、strings.Cut/SplitSeq、strings.Builder（修复 mail.go O(n²) 拼接）。逐 hunk 核对语义等价；omitzero 冲突修复被自动跳过（wire 格式不变）；手动清 4 处遗留 sort import + 2 处 QF1012。","timestamp":1786872502383,"segment":0,"confidence":17,"asi":{"hypothesis":"批量应用 modernize 自动修复（interface{}→any、max/min、slices.Sort/Contains、strings.Cut/SplitSeq、maps.Copy、strings.Builder）","insight":"golangci-lint --fix 会把 omitempty→omitzero 的冲突修复跳过（2个文件保留原 tag，wire 格式不变，好）；但 fixer 会遗留未使用的 sort import，需手动清 4 处；mail.go 的 Builder 迁移附带暴露 2 个 QF1012，顺手用 fmt.Fprintf 修复。全部修复语义等价，已逐项核对 diff","next_action_hint":"剩余 modernize=5 应为 omitzero 冲突文件；下轮先处理 perfsprint(18)：先看 --fix 是否安全再决定"}}
+{"run":4,"commit":"699e95f","metric":56,"metrics":{"golint_canonicalheader":8,"golint_errname":1,"golint_errorlint":12,"golint_forcetypeassert":3,"golint_gosec":0,"golint_intrange":3,"golint_modernize":5,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":3,"golint_recvcheck":7,"golint_usestdlibvars":3,"golint_wastedassign":7,"golint_total":55,"eslint_problems":1,"eslint_errors":0,"eslint_warnings":1,"tsc_errors":0,"measure_s":47},"status":"keep","description":"perfsprint 18→0：strconv.Itoa/FormatInt/FormatUint/FormatBool 替代 fmt.Sprintf、无动词 fmt.Errorf→errors.New、纯字符串拼接。全部语义等价（已核对 diff）。修正 fixer 遗留的 import 问题（引入 goimports 统一整理）。","timestamp":1786872884713,"segment":0,"confidence":3.0588235294117645,"asi":{"hypothesis":"perfsprint --fix：%d→strconv.Itoa/FormatInt、%t→FormatBool、%s+const→拼接、无动词 Errorf→errors.New","insight":"重要：golangci-lint v2 fixer 的 import 管理不可靠（删除/添加 import 会出错，53 个文件中 5 处报 undefined）+ 遗留未用 import。已安装 goimports（repo make format 本来就需要它），对改动文件统一 goimports -w 修复。后续只要用 --fix 就要记得跑 goimports -w","next_action_hint":"剩余大头：errorlint(12)、canonicalheader(8)（usestdlibvars 同类）、recvcheck(7)、wastedassign(7)。errorlint 需手工逐处判断；先做 canonicalheader+usestdlibvars（自动可修复但要核对）"}}

internal/apps/admin/updater/logics.go

@@ -194,7 +194,7 @@ func (m *manager) fetchRelease(ctx context.Context, repository string) (githubRe
 	}
 	req.Header.Set("Accept", "application/vnd.github+json")
 	req.Header.Set("User-Agent", "OpenFlare-Updater")
-	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+	req.Header.Set("X-Github-Api-Version", "2022-11-28")
 
 	resp, err := m.client.Do(req)
 	if err != nil {

internal/apps/agent/observability/openresty_local.go

@@ -62,7 +62,7 @@ func CollectEdgeHealth(ctx context.Context, cfg *config.Config) *EdgeHealthSnaps
 }
 
 func fetchLocalJSON(ctx context.Context, client *http.Client, url string, target any) error {
-	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return err
 	}

internal/apps/openflare/waf/ip_group_sync.go

@@ -403,7 +403,7 @@ func downloadIPGroupSubscription(ctx context.Context, rawURL string) ([]byte, er
 		return nil, err
 	}
 	client := http.Client{Timeout: 15 * time.Second}
-	req, err := http.NewRequestWithContext(ctx, "GET", rawURL, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
 	if err != nil {
 		return nil, fmt.Errorf("下载订阅失败: %w", err)
 	}

internal/integration/githubrelease/client.go

@@ -338,7 +338,7 @@ func (client *Client) Resolve(ctx context.Context, request ResolveRequest) (Reso
 	return ResolveResult{}, safeError(
 		errAssetMissing,
 		response.StatusCode,
-		response.Header.Get("X-GitHub-Request-Id"),
+		response.Header.Get("X-Github-Request-Id"),
 		repository,
 		release.Tag,
 		request.AssetName,
@@ -379,7 +379,7 @@ func (client *Client) Download(ctx context.Context, request DownloadRequest) (*D
 
 	result, err := client.streamAsset(response.Body, request.MaxBytes, request.Asset.Digest)
 	if err != nil {
-		return nil, safeError(err, response.StatusCode, response.Header.Get("X-GitHub-Request-Id"), repository, "", request.Asset.Name, nil, retryAt)
+		return nil, safeError(err, response.StatusCode, response.Header.Get("X-Github-Request-Id"), repository, "", request.Asset.Name, nil, retryAt)
 	}
 	return result, nil
 }
@@ -682,7 +682,7 @@ func safeHTTPError(kind error, response *http.Response, repository string, tag s
 	return safeError(
 		kind,
 		response.StatusCode,
-		response.Header.Get("X-GitHub-Request-Id"),
+		response.Header.Get("X-Github-Request-Id"),
 		repository,
 		tag,
 		assetName,

internal/integration/githubrelease/transport.go

@@ -148,7 +148,7 @@ func newClient(options clientOptions) *Client {
 func applyMetadataHeaders(request *http.Request, etag string) {
 	request.Header.Set("Accept", metadataAccept)
 	request.Header.Set("User-Agent", defaultUserAgent)
-	request.Header.Set("X-GitHub-Api-Version", APIVersion)
+	request.Header.Set("X-Github-Api-Version", APIVersion)
 	if etag = safeETag(etag); etag != "" {
 		request.Header.Set("If-None-Match", etag)
 	}
@@ -158,7 +158,7 @@ func applyAssetHeaders(request *http.Request) {
 	request.Header.Set("Accept", assetAccept)
 	request.Header.Set("Accept-Encoding", "identity")
 	request.Header.Set("User-Agent", defaultUserAgent)
-	request.Header.Set("X-GitHub-Api-Version", APIVersion)
+	request.Header.Set("X-Github-Api-Version", APIVersion)
 }
 
 func stripCrossHostHeaders(request *http.Request) {
@@ -300,10 +300,10 @@ func responseRetryAt(response *http.Response, now time.Time) *time.Time {
 			return &retryAt
 		}
 	}
-	if strings.TrimSpace(response.Header.Get("X-RateLimit-Remaining")) != "0" {
+	if strings.TrimSpace(response.Header.Get("X-Ratelimit-Remaining")) != "0" {
 		return nil
 	}
-	reset, err := strconv.ParseInt(strings.TrimSpace(response.Header.Get("X-RateLimit-Reset")), 10, 64)
+	reset, err := strconv.ParseInt(strings.TrimSpace(response.Header.Get("X-Ratelimit-Reset")), 10, 64)
 	if err != nil || reset <= 0 {
 		return nil
 	}

internal/router/middlewares.go

@@ -109,7 +109,7 @@ func corsMiddleware() gin.HandlerFunc {
 			c.Writer.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS, GET, PUT, DELETE, PATCH")
 		}
 
-		if c.Request.Method == "OPTIONS" {
+		if c.Request.Method == http.MethodOptions {
 			c.AbortWithStatus(http.StatusNoContent)
 			return
 		}