ci: 限制 Go 门禁并发峰值

将 GOFLAGS=-p=1 与 GOMAXPROCS=1 收窄到 Go 验证步骤，降低 2 GiB rootless DinD runner 冷编译时的峰值资源占用。\n\n同时增加流水线结构契约测试，确保主分支与发布工作流都保留相同限制且不会扩散到 Trivy 等其他工具。

.gitea/workflows/ci.yml

@@ -81,6 +81,9 @@ jobs:
           }
       - name: Verify Go code
         working-directory: apps/api
+        env:
+          GOFLAGS: "-p=1"
+          GOMAXPROCS: "1"
         run: |
           go vet ./...
           go test ./...

.gitea/workflows/release-ci.yml

@@ -66,6 +66,9 @@ jobs:
           }
       - name: Verify Go code
         working-directory: apps/api
+        env:
+          GOFLAGS: "-p=1"
+          GOMAXPROCS: "1"
         run: |
           go vet ./...
           go test ./...

tests/ci/pipeline-test.sh

@@ -18,6 +18,42 @@ adr=$root/docs/decisions/001-production-cicd.md
 runbook=$root/docs/runbooks/production-ci-cd.md
 migrator=$root/apps/api/cmd/migrate/main.go
 
+assert_bounded_go_verification() {
+  local quality_workflow=$1
+
+  awk '
+    /^[[:space:]]+GOFLAGS:/ { all_goflags++ }
+    /^[[:space:]]+GOMAXPROCS:/ { all_gomaxprocs++ }
+    /^      - name: Verify Go code$/ {
+      target_steps++
+      in_target=1
+      in_env=0
+      next
+    }
+    /^      - / {
+      in_target=0
+      in_env=0
+    }
+    in_target && /^        env:$/ {
+      env_blocks++
+      in_env=1
+      next
+    }
+    in_target && in_env && /^          GOFLAGS: "-p=1"$/ { target_goflags++ }
+    in_target && in_env && /^          GOMAXPROCS: "1"$/ { target_gomaxprocs++ }
+    in_target && in_env && /^        [^ ]/ { in_env=0 }
+    END {
+      exit !(target_steps == 1 && env_blocks == 1 &&
+        target_goflags == 1 && target_gomaxprocs == 1 &&
+        all_goflags == 1 && all_gomaxprocs == 1)
+    }
+  ' "$quality_workflow" || {
+    printf '%s must limit Go parallelism exactly once in the Verify Go code step\n' \
+      "$quality_workflow" >&2
+    exit 1
+  }
+}
+
 for file in "$workflow" "$release_workflow" "$runner_service" "$runner_config" "$provision" "$build_images" "$validate_semver" "$validate_migrations" "$build_images_test" "$migrations_test" "$migration_base" "$adr" "$runbook" "$migrator"; do
   [[ -f $file ]] || {
     printf 'missing CI/CD file: %s\n' "$file" >&2
@@ -128,6 +164,7 @@ for quality_workflow in "$workflow" "$release_workflow"; do
         "$quality_workflow" >&2
       exit 1
     }
+  assert_bounded_go_verification "$quality_workflow"
   grep -Fq 'production_base=$(cat deploy/ci/production-migration-base)' \
     "$quality_workflow" || {
       printf '%s does not read the versioned production migration baseline\n' \