fix(lint): resolve errcheck and goconst issues

- Add nolint comments for sync.Pool.Get() type assertions (pool always returns valid pointers)
- Extract TLS version strings to constants in sslutil/tlsconfig.go
- Extract expires directive strings to constants in handler/static.go

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/cache/file_cache.go

@@ -180,7 +180,7 @@ func (c *FileCache) Set(path string, data []byte, size int64, modTime time.Time)
 	}
 
 	// 从池中获取条目并初始化
-	entry := c.entryPool.Get().(*FileEntry)
+	entry := c.entryPool.Get().(*FileEntry) //nolint:errcheck // pool always returns valid *FileEntry
 	entry.Path = path
 	entry.Data = data
 	entry.Size = size

internal/cache/sharded_cache.go

@@ -177,7 +177,7 @@ func (sh *FileCacheShard) Set(path string, data []byte, size int64, modTime time
 		return nil
 	}
 
-	entry := sh.entryPool.Get().(*FileEntry)
+	entry := sh.entryPool.Get().(*FileEntry) //nolint:errcheck // pool always returns valid *FileEntry
 	entry.Path = path
 	entry.Data = data
 	entry.Size = size

internal/handler/static.go

@@ -35,6 +35,12 @@ import (
 
 const httpTimeFormat = "Mon, 02 Jan 2006 15:04:05 GMT"
 
+// Expires directive constants
+const (
+	expiresOff = "off"
+	expiresMax = "max"
+)
+
 // StaticHandler 静态文件处理器。
 //
 // 提供静态文件服务，支持目录索引、文件缓存和零拷贝传输。
@@ -662,7 +668,7 @@ func (h *StaticHandler) serveFile(ctx *fasthttp.RequestCtx, filePath string, inf
 
 // setCacheHeaders 设置缓存控制响应头。
 func (h *StaticHandler) setCacheHeaders(ctx *fasthttp.RequestCtx) {
-	if h.expires == "" || h.expires == "off" {
+	if h.expires == "" || h.expires == expiresOff {
 		return
 	}
 
@@ -672,7 +678,7 @@ func (h *StaticHandler) setCacheHeaders(ctx *fasthttp.RequestCtx) {
 		return
 	}
 
-	if h.expires == "max" {
+	if h.expires == expiresMax {
 		ctx.Response.Header.Set("Cache-Control", "public, max-age=315360000, immutable")
 		ctx.Response.Header.Set("Expires", time.Now().Add(315360000*time.Second).UTC().Format(httpTimeFormat))
 		return
@@ -689,10 +695,10 @@ func (h *StaticHandler) setCacheHeaders(ctx *fasthttp.RequestCtx) {
 // 支持格式：30d, 1h, 1m, 1s, 30d1h 等
 // 返回秒数。
 func parseExpires(expires string) int64 {
-	if expires == "" || expires == "off" {
+	if expires == "" || expires == expiresOff {
 		return 0
 	}
-	if expires == "max" {
+	if expires == expiresMax {
 		return 315360000
 	}
 	if expires == "epoch" {

internal/lua/helpers.go

@@ -52,5 +52,5 @@ func GetOrCreateNgxSubTable(ngx *glua.LTable, L *glua.LState, name string) *glua
 		ngx.RawSetString(name, sub)
 		return sub
 	}
-	return existing.(*glua.LTable)
+	return existing.(*glua.LTable) //nolint:errcheck // RawGetString returns LNil or valid LValue
 }

internal/proxy/websocket.go

@@ -127,7 +127,7 @@ func (b *WebSocketBridge) Bridge() error {
 // 返回值：
 //   - error: 读写错误，连接正常关闭返回 nil
 func (b *WebSocketBridge) copyData(dst, src net.Conn, direction string) error {
-	bufPtr := wsBufPool.Get().(*[]byte)
+	bufPtr := wsBufPool.Get().(*[]byte) //nolint:errcheck // pool always returns valid *[]byte
 	buf := *bufPtr
 	defer wsBufPool.Put(bufPtr)
 

internal/sslutil/tlsconfig.go

@@ -7,6 +7,14 @@ import (
 	"slices"
 )
 
+// TLS version string constants
+const (
+	tlsV12Lower = "TLSv1.2"
+	tlsV13Lower = "TLSv1.3"
+	tlsV12Upper = "TLSV1.2"
+	tlsV13Upper = "TLSV1.3"
+)
+
 // ParseTLSVersion parses a TLS version string to a tls constant.
 //
 // Parameters:
@@ -21,9 +29,9 @@ func ParseTLSVersion(version string) (uint16, error) {
 		return tls.VersionTLS10, nil
 	case "TLSv1.1", "TLSV1.1":
 		return tls.VersionTLS11, nil
-	case "TLSv1.2", "TLSV1.2":
+	case tlsV12Lower, tlsV12Upper:
 		return tls.VersionTLS12, nil
-	case "TLSv1.3", "TLSV1.3":
+	case tlsV13Lower, tlsV13Upper:
 		return tls.VersionTLS13, nil
 	case "":
 		return 0, nil // Empty string means use default
@@ -50,11 +58,11 @@ func ParseTLSVersions(protocols []string) (uint16, uint16, error) {
 
 	for _, p := range protocols {
 		switch p {
-		case "TLSv1.2", "TLSV1.2":
+		case tlsV12Lower, tlsV12Upper:
 			if minVer > tls.VersionTLS12 {
 				minVer = tls.VersionTLS12
 			}
-		case "TLSv1.3", "TLSV1.3":
+		case tlsV13Lower, tlsV13Upper:
 			maxVer = tls.VersionTLS13
 		case "TLSv1.0", "TLSV1.0", "TLSv1.1", "TLSV1.1":
 			return 0, 0, fmt.Errorf("insecure TLS version %s is not supported", p)
@@ -76,9 +84,9 @@ func ParseTLSVersions(protocols []string) (uint16, uint16, error) {
 func ParseMinTLSVersion(protocols []string) uint16 {
 	for _, p := range protocols {
 		switch p {
-		case "TLSv1.3", "TLSV1.3":
+		case tlsV13Lower, tlsV13Upper:
 			return tls.VersionTLS13
-		case "TLSv1.2", "TLSV1.2":
+		case tlsV12Lower, tlsV12Upper:
 			return tls.VersionTLS12
 		}
 	}

internal/stream/stream.go

@@ -81,7 +81,7 @@ func newRoundRobin() Balancer {
 
 func (r *roundRobin) Select(targets []*Target) *Target {
 	// 从池中获取 healthy slice 并复用
-	healthyPtr := r.healthyPool.Get().(*[]*Target)
+	healthyPtr := r.healthyPool.Get().(*[]*Target) //nolint:errcheck // pool always returns valid *[]*Target
 	healthy := *healthyPtr
 	healthy = healthy[:0] // 清空但保留容量
 	for _, t := range targets {
@@ -169,7 +169,7 @@ func newWeightedRoundRobin() Balancer {
 }
 
 func (w *weightedRoundRobin) Select(targets []*Target) *Target {
-	healthyPtr := w.healthyPool.Get().(*[]*Target)
+	healthyPtr := w.healthyPool.Get().(*[]*Target) //nolint:errcheck // pool always returns valid *[]*Target
 	healthy := *healthyPtr
 	healthy = healthy[:0]
 	for _, t := range targets {
@@ -246,7 +246,7 @@ func (i *ipHash) Select(targets []*Target) *Target {
 }
 
 func (i *ipHash) SelectByIP(targets []*Target, clientIP string) *Target {
-	healthyPtr := i.healthyPool.Get().(*[]*Target)
+	healthyPtr := i.healthyPool.Get().(*[]*Target) //nolint:errcheck // pool always returns valid *[]*Target
 	healthy := *healthyPtr
 	healthy = healthy[:0]
 	for _, t := range targets {