diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a8347c7..c892159 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -20,6 +20,9 @@ jobs:
       - name: Build
         run: go build ./...
 
+      - name: Install golangci-lint
+        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6
+
       - name: Lint
         run: make lint
 
diff --git a/.golangci.yml b/.golangci.yml
index c1a371a..3c5c85d 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -21,6 +21,9 @@ linters:
     - misspell       # spelling mistakes in identifiers
 
   settings:
+    misspell:
+      ignore-rules:
+        - creater  # GitLink API/DB 字段拼写（creater_id），非笔误
     gosec:
       excludes:
         - G104  # errcheck already handles unchecked errors
@@ -57,3 +60,6 @@ linters:
       # apiInt: intentional uint64->int truncation for API response parsing
       - linters: [gosec]
         text: "G115: integer overflow conversion uint64 -> int"
+      # apiInt: same intentional truncation for uint on 32-bit platforms
+      - linters: [gosec]
+        text: "G115: integer overflow conversion uint -> int"
diff --git a/examples/workflows/project-bootstrap-automation/scripts/bootstrap_project.go b/examples/workflows/project-bootstrap-automation/scripts/bootstrap_project.go
index cdf0144..e805cda 100644
--- a/examples/workflows/project-bootstrap-automation/scripts/bootstrap_project.go
+++ b/examples/workflows/project-bootstrap-automation/scripts/bootstrap_project.go
@@ -268,9 +268,9 @@ func runCommand(cliBin string, args []string, apply bool) CommandResult {
 	if !apply {
 		return CommandResult{Command: command, Status: "planned"}
 	}
-	cmd := exec.Command(cliBin, args...)
+	cmd := exec.Command(cliBin, args...) // #nosec G204 -- cliBin 与 args 由用户配置显式给出，CLI 包装器的预期行为
 	if strings.HasSuffix(strings.ToLower(cliBin), ".cmd") || strings.HasSuffix(strings.ToLower(cliBin), ".bat") {
-		cmd = exec.Command("cmd", append([]string{"/c", cliBin}, args...)...)
+		cmd = exec.Command("cmd", append([]string{"/c", cliBin}, args...)...) // #nosec G204
 	}
 	var stdout, stderr bytes.Buffer
 	cmd.Stdout = &stdout
@@ -318,7 +318,7 @@ func writeOutputs(config ProjectConfig, outputDir string, now time.Time) (Output
 	owner := config.Repository.Owner
 	repo := config.Repository.Name
 	prefix := fmt.Sprintf("%s_%s_%s", safeName(owner), safeName(repo), now.UTC().Format("20060102_150405"))
-	if err := os.MkdirAll(outputDir, 0o755); err != nil {
+	if err := os.MkdirAll(outputDir, 0o750); err != nil {
 		return OutputPaths{}, err
 	}
 	files := plannedFiles(config)
@@ -367,7 +367,7 @@ func writeOutputs(config ProjectConfig, outputDir string, now time.Time) (Output
 		paths.Files:    filesJSON,
 	}
 	for path, data := range writes {
-		if err := os.WriteFile(path, data, 0o644); err != nil {
+		if err := os.WriteFile(path, data, 0o600); err != nil {
 			return OutputPaths{}, err
 		}
 	}
@@ -455,7 +455,7 @@ func main() {
 		os.Exit(1)
 	}
 	commandLogPath := filepath.Join(opts.OutputDir, fmt.Sprintf("command_log_%s.json", now.UTC().Format("20060102_150405")))
-	if err := os.WriteFile(commandLogPath, commandLogJSON, 0o644); err != nil {
+	if err := os.WriteFile(commandLogPath, commandLogJSON, 0o600); err != nil {
 		fmt.Fprintf(os.Stderr, "写入命令日志失败: %v\n", err)
 		os.Exit(1)
 	}
diff --git a/shortcuts/health/db.go b/shortcuts/health/db.go
index 0a1926b..10534d7 100644
--- a/shortcuts/health/db.go
+++ b/shortcuts/health/db.go
@@ -44,11 +44,11 @@ func openDB(path string) (*sql.DB, error) {
 		return nil, fmt.Errorf("open database: %w", err)
 	}
 	if _, err := db.Exec("PRAGMA journal_mode=WAL"); err != nil {
-		db.Close()
+		_ = db.Close()
 		return nil, fmt.Errorf("set WAL mode: %w", err)
 	}
 	if _, err := db.Exec(schemaSQL); err != nil {
-		db.Close()
+		_ = db.Close()
 		return nil, fmt.Errorf("init schema: %w", err)
 	}
 	return db, nil
diff --git a/shortcuts/health/health.go b/shortcuts/health/health.go
index 04f26d1..088af39 100644
--- a/shortcuts/health/health.go
+++ b/shortcuts/health/health.go
@@ -48,7 +48,7 @@ func Shortcuts(translators ...*i18n.Translator) []*common.Shortcut {
 				if err != nil {
 					return err
 				}
-				defer db.Close()
+				defer func() { _ = db.Close() }()
 
 				repoID, err := getOrCreateRepo(db, ctx.Repo, ctx.Owner)
 				if err != nil {
diff --git a/shortcuts/pr/pr.go b/shortcuts/pr/pr.go
index 03f537f..3b56ced 100644
--- a/shortcuts/pr/pr.go
+++ b/shortcuts/pr/pr.go
@@ -390,7 +390,7 @@ func Shortcuts(translators ...*i18n.Translator) []*common.Shortcut {
 							"approved": "approved", "rejected": "rejected", "common": "commented",
 						}[status]
 						summary := fmt.Sprintf("## Review: %s\n\n%s", statusLabel, content)
-						ctx.CallAPI("POST", fmt.Sprintf("/v1/%s/%s/issues/%d/journals", ctx.Owner, ctx.Repo, issueID),
+						_, _ = ctx.CallAPI("POST", fmt.Sprintf("/v1/%s/%s/issues/%d/journals", ctx.Owner, ctx.Repo, issueID),
 							map[string]interface{}{"notes": summary})
 					}
 				}