ci: 加 -race + golangci-lint(new-issues) + govulncheck/gitleaks 安全扫描

补齐审计指出的「CI 缺 lint/安全扫描/-race」低成本质量门:

- go job:go test → go test -race(4 模块本地已验证 race-clean,ubuntu 自带 gcc)。
- lint job:golangci-lint(standard 集)仅 PR 跑 + only-new-issues —— 新代码必须干净,
  存量 ~42 处(多为未检 Close/死代码)单独消化,不拿存量红门。加 .golangci.yml(测试放过 errcheck)。
- security job:govulncheck advisory(stdlib/nats CVE 靠 toolchain/依赖升级,只做可见性不阻断)
  + gitleaks 扫提交防密钥泄漏。
- 顺手清掉本会话新代码的 lint:blob GetBytes 的 defer Close、退款测试未检 CreateOrder。

注:gitleaks-action 个人/公开仓库免费;组织仓库需 GITLEAKS_LICENSE。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -23,15 +23,67 @@ jobs:
         with:
           go-version: "1.25"
           cache-dependency-path: "**/go.sum"
-      - name: build + vet + test（4 模块；bus 用内嵌 NATS，无需外部服务）
+      - name: build + vet + test -race（4 模块；bus 用内嵌 NATS，无需外部服务）
         run: |
           set -e
           for m in sundynix-shared sundynix-gateway sundynix-dispatcher sundynix-mcp-go; do
             echo "::group::$m"
-            (cd "$m" && go build ./... && go vet ./... && go test ./...)
+            # -race：数据竞争一票否决（4 模块本地已验证 race-clean）。ubuntu runner 自带 gcc，CGO 可用。
+            (cd "$m" && go build ./... && go vet ./... && go test -race ./...)
             echo "::endgroup::"
           done
 
+  # golangci-lint：只卡「新问题」——存量约 42 处(未检 Close/死代码)单独消化，不拿存量红门。
+  # 仅在 PR 跑：dev→main 的 PR 是唯一合入口，据 base 算 diff；push 到 main 不重复跑。
+  lint:
+    name: Go · golangci-lint (new issues)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        module: [sundynix-shared, sundynix-gateway, sundynix-dispatcher, sundynix-mcp-go]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # only-new-issues 要据 base 分支算 diff，需完整历史
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache-dependency-path: "**/go.sum"
+      - uses: golangci/golangci-lint-action@v6
+        with:
+          version: latest
+          working-directory: ${{ matrix.module }}
+          only-new-issues: true
+
+  # 安全扫描：govulncheck(依赖 CVE) advisory —— stdlib/nats CVE 要靠 toolchain/依赖升级，
+  # 不拿它红门，只做可见性；gitleaks(密钥泄漏)在 PR 上扫 diff，硬拦提交密钥。
+  security:
+    name: Security · govulncheck + gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.25"
+          cache-dependency-path: "**/go.sum"
+      - name: govulncheck（advisory：报告不阻断）
+        continue-on-error: true
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          for m in sundynix-shared sundynix-gateway sundynix-dispatcher sundynix-mcp-go; do
+            echo "::group::govulncheck $m"
+            (cd "$m" && govulncheck ./...) || true
+            echo "::endgroup::"
+          done
+      - name: gitleaks（扫提交历史，命中即失败）
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   web:
     name: Frontend · tsc + vitest
     runs-on: ubuntu-latest