refactor(api): 重新引入业务错误重构，并收敛 diff lint 作用域

.github/workflows/backend-pr.yml

@@ -48,11 +48,15 @@ jobs:
           go env -w GOPROXY=https://goproxy.cn,direct
           go mod download
 
-      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v8
-        with:
-          version: ${{ env.GOLANGCI_LINT_VERSION }}
-          working-directory: backend
+      - name: Prepare upstream base for lint-diff
+        run: |
+          if ! git remote get-url upstream >/dev/null 2>&1; then
+            git remote add upstream https://github.com/raids-lab/crater.git
+          fi
+          git fetch upstream main --depth=1
+
+      - name: Run make lint
+        run: make lint
 
   backend-build-check:
     runs-on: ubuntu-latest

.github/workflows/storage-pr.yml

@@ -52,11 +52,15 @@ jobs:
           go env -w GOPROXY=https://goproxy.cn,direct
           go mod download
 
-      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v8
-        with:
-          version: ${{ env.GOLANGCI_LINT_VERSION }}
-          working-directory: backend
+      - name: Prepare upstream base for lint-diff
+        run: |
+          if ! git remote get-url upstream >/dev/null 2>&1; then
+            git remote add upstream https://github.com/raids-lab/crater.git
+          fi
+          git fetch upstream main --depth=1
+
+      - name: Run make lint
+        run: make lint
 
   storage-build-check:
     runs-on: ubuntu-latest

backend/.golangci-diff.yml

@@ -0,0 +1,72 @@
+version: "2"
+linters:
+  default: none
+  enable:
+    - forbidigo
+    - staticcheck
+  settings:
+    forbidigo:
+      forbid:
+        # 1. 禁止原生的错误构造函数
+        - pattern: ^fmt\.Errorf$
+          msg: "禁止直接使用 fmt.Errorf。请使用 bizerr.<Group>.<Code>.Wrap(err, msg) 或 .New(msg)"
+        - pattern: ^errors\.New$
+          msg: "禁止直接使用 errors.New。请使用 bizerr.<Group>.<Code>.New(msg)"
+
+        # 2. 如果你引入了 pkg/errors (github.com/pkg/errors)，也建议禁用
+        - pattern: ^errors\.Errorf$
+          msg: "禁止使用 pkg/errors.Errorf。请使用 bizerr 体系"
+        - pattern: ^errors\.Wrap(f)?$
+          msg: "禁止使用 pkg/errors.Wrap。请使用 bizerr.<Group>.<Code>.Wrap"
+      exclude-godoc-examples: true
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - forbidigo
+        path-except: ^internal/(handler|service)/
+      - linters:
+          - staticcheck
+        path: pkg/golinters/errcheck.go
+        text: "SA1019: errCfg.Exclude is deprecated: use ExcludeFunctions instead"
+      - linters:
+          - staticcheck
+        path: pkg/commands/run.go
+        text: "SA1019: lsc.Errcheck.Exclude is deprecated: use ExcludeFunctions instead"
+      - linters:
+          - staticcheck
+        path: pkg/commands/run.go
+        text: "SA1019: c.cfg.Run.ShowStats is deprecated: use Output.ShowStats instead."
+      - path: pkg/golinters/govet.go
+        text: "SA1019: cfg.CheckShadowing is deprecated: the linter should be enabled inside `Enable`."
+      - path: pkg/commands/config.go
+        text: "SA1019: cfg.Run.UseDefaultSkipDirs is deprecated: use Issues.UseDefaultExcludeDirs instead."
+      - linters:
+          - staticcheck
+        path: pkg/golinters/godot.go
+        text: "SA1019: settings.CheckAll is deprecated: use `Scope` instead"
+      - linters:
+          - staticcheck
+        path: pkg/golinters/gofumpt.go
+        text: "SA1019: settings.LangVersion is deprecated: use the global `run.go` instead."
+      - linters:
+          - staticcheck
+        path: pkg/golinters/staticcheck_common.go
+        text: "SA1019: settings.GoVersion is deprecated: use the global `run.go` instead."
+      - linters:
+          - staticcheck
+        path: pkg/lint/lintersdb/manager.go
+        text: "SA1019: (.+).(GoVersion|LangVersion) is deprecated: use the global `run.go` instead."
+    paths:
+      - test/testdata_etc
+      - internal/cache
+      - internal/renameio
+      - internal/robustio
+      - third_party$
+      - builtin$
+      - examples$

backend/.golangci.yml → backend/.golangci-full.yml

@@ -158,6 +158,10 @@ linters:
           - staticcheck
         path: pkg/lint/lintersdb/manager.go
         text: "SA1019: (.+).(GoVersion|LangVersion) is deprecated: use the global `run.go` instead."
+      - linters:
+          - staticcheck
+        path: internal/(handler|middleware|storage)/.*\.go
+        text: 'SA1019: resputil\.[A-Za-z0-9_]+ is deprecated: .*'
       - linters:
           - gocritic
         path: pkg/golinters/unused.go
@@ -191,4 +195,4 @@ formatters:
       - internal/robustio
       - third_party$
       - builtin$
-      - examples$
+      - examples$

backend/CONTRIBUTING.md

@@ -82,7 +82,8 @@ When changing job creation configuration fields, request/response schema, or tem
 ## Errors And Security
 
 - Use RESTful-compliant HTTP status codes; do not use `Error()` everywhere. Pick the response helper that matches the semantics.
-- Define and use precise business codes in `backend/internal/resputil/code.go` as needed.
+- For new code, return `bizerr` errors and send them with `resputil.HandleError`; keep `backend/internal/resputil/code.go` only for legacy compatibility.
+- Define new business error codes in `backend/internal/bizerr/groups.go` as needed.
 - Error messages returned to the frontend must be clear, accurate English.
 - Never concatenate SQL strings in `backend/internal/storage/` or the DAO layer; use parameterized queries.
 - Never hardcode secrets, tokens, passwords, internal IPs, kubeconfigs, or production credentials.

backend/CONTRIBUTING.zh-CN.md

@@ -82,7 +82,8 @@ make run
 ## 错误处理与安全
 
 - 使用符合 RESTful 语义的 HTTP 状态码；不要到处使用 `Error()`，应选择语义匹配的响应 helper。
-- 按需在 `backend/internal/resputil/code.go` 定义并使用精准业务状态码。
+- 新代码应返回 `bizerr` 错误并通过 `resputil.HandleError` 输出；`backend/internal/resputil/code.go` 仅保留为旧代码兼容入口。
+- 需要新增业务错误码时，在 `backend/internal/bizerr/groups.go` 中定义。
 - 返回给前端的错误信息必须是清晰、准确的英文。
 - 严禁在 `backend/internal/storage/` 或 DAO 层拼接 SQL 字符串，必须使用参数化查询。
 - 严禁硬编码密钥、Token、密码、内网 IP、kubeconfig 或生产凭据。

backend/Makefile

@@ -1,5 +1,11 @@
 KUBECONFIG_PATH := $(if $(KUBECONFIG),$(KUBECONFIG),${PWD}/kubeconfig)
 CONFIG_FILE := ./etc/debug-config.yaml
+CACHE_DIR := $(PWD)/.cache
+GOCACHE ?= $(CACHE_DIR)/go-build
+GOLANGCI_LINT_CACHE ?= $(CACHE_DIR)/golangci-lint
+
+export GOCACHE
+export GOLANGCI_LINT_CACHE
 
 # Version information for development builds
 # DEV_APP_VERSION ?= 1234567
@@ -119,9 +125,23 @@ import-check: goimports ## Check if goimports is needed.
 	fi
 
 .PHONY: lint
-lint: fmt imports import-check golangci-lint ## Lint go files.
-	@echo "$(BLUE)Linting go files...$(RESET)"
-	$(GOLANGCI_LINT) run --timeout 5m
+lint: lint-full lint-diff
+	@echo "$(BLUE)Lint finished.$(RESET)"
+
+.PHONY: lint-full
+lint-full: golangci-lint
+	@echo "$(BLUE)Linting full codebase (ignore deprecated)...$(RESET)"
+	$(GOLANGCI_LINT) run \
+		-c .golangci-full.yml\
+		--timeout 5m
+
+.PHONY: lint-diff
+lint-diff: golangci-lint
+	@echo "$(BLUE)Linting changed code (ignore deprecated)...$(RESET)"
+	$(GOLANGCI_LINT) run \
+		-c .golangci-diff.yml\
+		--new-from-rev=upstream/main \
+		--timeout 5m
 
 .PHONY: curd
 curd: ## Generate Gorm CURD code.
@@ -168,7 +188,7 @@ build-migrate: fmt lint ## Build migration binary.
 ## Location to install tools to
 LOCALBIN ?= $(PWD)/bin
 $(LOCALBIN):
-	mkdir -p $(LOCALBIN)
+	mkdir -p $(LOCALBIN) $(GOCACHE) $(GOLANGCI_LINT_CACHE)
 
 ## Tool Binaries
 GOLANGCI_LINT ?= $(LOCALBIN)/golangci-lint