fix(ci): 修复 PR 检查失败

- 升级 CI 校验的 Go patch 版本以通过 govulncheck
- 修复 golangci-lint 报告的无效赋值和未检查类型断言
- 更新 API contract 与 scheduler snapshot 测试数据
- 将外部 TLS 指纹服务的 EOF/握手失败识别为外部服务不可用并跳过

验证：
- golangci-lint run --timeout=30m
- go test -tags=unit ./...
- go test -tags=integration ./...
- govulncheck ./...
- pnpm build

提交前已检查暂存清单，未包含 backend/data、test/release、日志、pprof、tar 或构建产物。

Author: PIXEL-AI-API

.github/workflows/backend-ci.yml

@@ -20,7 +20,7 @@ jobs:
           cache-dependency-path: backend/go.sum
       - name: Verify Go version
         run: |
-          go version | grep -q 'go1.26.3'
+          go version | grep -q 'go1.26.4'
       - name: Unit tests
         working-directory: backend
         run: make test-unit
@@ -60,7 +60,7 @@ jobs:
           cache-dependency-path: backend/go.sum
       - name: Verify Go version
         run: |
-          go version | grep -q 'go1.26.3'
+          go version | grep -q 'go1.26.4'
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:

.github/workflows/release.yml

@@ -115,7 +115,7 @@ jobs:
 
       - name: Verify Go version
         run: |
-          go version | grep -q 'go1.26.3'
+          go version | grep -q 'go1.26.4'
 
       # Docker setup for GoReleaser
       - name: Set up QEMU

.github/workflows/security-scan.yml

@@ -23,7 +23,7 @@ jobs:
           cache-dependency-path: backend/go.sum
       - name: Verify Go version
         run: |
-          go version | grep -q 'go1.26.3'
+          go version | grep -q 'go1.26.4'
       - name: Run govulncheck
         working-directory: backend
         run: |

backend/go.mod

@@ -1,6 +1,6 @@
 module github.com/Wei-Shaw/sub2api
 
-go 1.26.3
+go 1.26.4
 
 require (
 	entgo.io/ent v0.14.5

backend/internal/pkg/tlsfingerprint/dialer_integration_test.go

@@ -28,8 +28,13 @@ func skipIfExternalServiceUnavailable(t *testing.T, err error) {
 		if strings.Contains(errStr, "certificate has expired") ||
 			strings.Contains(errStr, "certificate is not yet valid") ||
 			strings.Contains(errStr, "connection refused") ||
+			strings.Contains(errStr, "connection reset") ||
 			strings.Contains(errStr, "no such host") ||
 			strings.Contains(errStr, "network is unreachable") ||
+			strings.Contains(errStr, "TLS handshake failed") ||
+			strings.Contains(errStr, "unexpected EOF") ||
+			strings.Contains(errStr, "EOF") ||
+			strings.Contains(errStr, "remote error") ||
 			strings.Contains(errStr, "timeout") ||
 			strings.Contains(errStr, "deadline exceeded") {
 			t.Skipf("skipping test: external service unavailable: %v", err)

backend/internal/server/api_contract_test.go

@@ -800,6 +800,7 @@ func TestAPIContracts(t *testing.T) {
 					"payment_visible_method_alipay_enabled": true,
 					"payment_visible_method_wxpay_enabled": false,
 					"openai_advanced_scheduler_enabled": true,
+					"openai_clean_relay_enabled": false,
 					"risk_control_enabled": false,
 					"openai_free_account_repair_enabled": false,
 					"openai_free_account_repair_weekly_threshold_usd": 60,
@@ -1033,6 +1034,7 @@ func TestAPIContracts(t *testing.T) {
 					"payment_visible_method_alipay_enabled": false,
 					"payment_visible_method_wxpay_enabled": false,
 					"openai_advanced_scheduler_enabled": false,
+					"openai_clean_relay_enabled": false,
 					"risk_control_enabled": false,
 					"openai_free_account_repair_enabled": false,
 					"openai_free_account_repair_weekly_threshold_usd": 60,

backend/internal/service/openai_gateway_chat_completions_raw.go

@@ -40,7 +40,6 @@ func (s *OpenAIGatewayService) forwardAsRawChatCompletions(
 	}
 	clientStream := gjson.GetBytes(body, "stream").Bool()
 	reasoningEffort := extractOpenAIReasoningEffortFromBody(body, originalModel)
-	serviceTier := extractOpenAIServiceTierFromBody(body)
 
 	billingModel := resolveOpenAIForwardModel(account, originalModel, defaultMappedModel)
 	upstreamModel := normalizeOpenAIModelForUpstream(account, billingModel)
@@ -59,7 +58,7 @@ func (s *OpenAIGatewayService) forwardAsRawChatCompletions(
 		}
 		return nil, err
 	}
-	serviceTier = extractOpenAIServiceTierFromBody(upstreamBody)
+	serviceTier := extractOpenAIServiceTierFromBody(upstreamBody)
 	if clientStream {
 		upstreamBody, err = ensureOpenAIChatStreamUsage(upstreamBody)
 		if err != nil {

backend/internal/service/openai_ws_forwarder_ingress_session_test.go

@@ -597,8 +597,15 @@ func TestOpenAIGatewayService_ProxyResponsesWebSocketFromClient_PassthroughModeR
 	require.Equal(t, 1, captureDialer.DialCount(), "passthrough 模式应直接建立上游 websocket")
 	require.Len(t, upstreamConn.writes, 1, "passthrough 模式应透传首条 response.create")
 	require.False(t, upstreamConn.writes[0]["previous_response_id"] != nil, "洁净中继 cold start 应清理客户端 previous_response_id")
-	require.Equal(t, "input_text", upstreamConn.writes[0]["input"].([]any)[0].(map[string]any)["type"])
-	require.Equal(t, openAICleanRelayInstallationID(account.ID), upstreamConn.writes[0]["client_metadata"].(map[string]any)[openAICleanRelayInstallationField])
+	upstreamInput, ok := upstreamConn.writes[0]["input"].([]any)
+	require.True(t, ok)
+	require.NotEmpty(t, upstreamInput)
+	upstreamInputItem, ok := upstreamInput[0].(map[string]any)
+	require.True(t, ok)
+	require.Equal(t, "input_text", upstreamInputItem["type"])
+	upstreamMetadata, ok := upstreamConn.writes[0]["client_metadata"].(map[string]any)
+	require.True(t, ok)
+	require.Equal(t, openAICleanRelayInstallationID(account.ID), upstreamMetadata[openAICleanRelayInstallationField])
 	require.NotEqual(t, "client-cache", upstreamConn.writes[0]["prompt_cache_key"])
 	require.Equal(t, openAICleanRelayInstallationID(account.ID), captureDialer.lastHeaders.Get(openAICleanRelayInstallationField))
 	require.NotEqual(t, "client-session", captureDialer.lastHeaders.Get("session_id"))

backend/internal/service/scheduler_snapshot_hydration_test.go

@@ -71,6 +71,7 @@ func TestOpenAISelectAccountWithLoadAwareness_HydratesSelectedAccountFromSchedul
 				Schedulable: true,
 				Concurrency: 1,
 				Priority:    1,
+				GroupIDs:    []int64{2},
 				Credentials: map[string]any{
 					"model_mapping": map[string]any{
 						"gpt-4": "gpt-4",
@@ -87,6 +88,7 @@ func TestOpenAISelectAccountWithLoadAwareness_HydratesSelectedAccountFromSchedul
 				Schedulable: true,
 				Concurrency: 1,
 				Priority:    1,
+				GroupIDs:    []int64{2},
 				Credentials: map[string]any{
 					"api_key":       "sk-live",
 					"model_mapping": map[string]any{"gpt-4": "gpt-4"},

backend/internal/service/usage_record_worker_pool.go

@@ -320,16 +320,24 @@ func (p *UsageRecordWorkerPool) execute(task UsageRecordTask) {
 
 	defer func() {
 		if recovered := recover(); recovered != nil {
-			logger.L().With(
-				zap.String("component", "service.usage_record_worker_pool"),
-				zap.Any("panic", recovered),
-			).Error("usage_record.task_panic")
+			logUsageRecordTaskPanic(recovered)
 		}
 	}()
 
 	task(ctx)
 }
 
+func logUsageRecordTaskPanic(recovered any) {
+	defer func() {
+		_ = recover()
+	}()
+
+	logger.L().With(
+		zap.String("component", "service.usage_record_worker_pool"),
+		zap.Any("panic", recovered),
+	).Error("usage_record.task_panic")
+}
+
 func (p *UsageRecordWorkerPool) logDrop(reason string) {
 	now := time.Now().UnixNano()
 	last := p.lastDropLogNanos.Load()