ci(gosec): silence G101 false positives on PAT context keys and scope const

gosec G101 flags apiTokenCtxKey, apiTokenLastUsedCtxKey, and the
ScopeNotificationGroupWrite identifier as hardcoded credentials. They are
context-key names and a scope string, not secrets. Annotate them with
#nosec G101 (matching the existing JWTSecretEnvKey precedent) so the
gosec CI step passes without disabling the rule globally.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

cmd/dashboard/controller/api_token.go

@@ -18,8 +18,8 @@ import (
 
 const (
 	apiTokenSecretLength    = 32                          // 明文 token 随机部分长度（hex 编码前）
-	apiTokenCtxKey          = "nz_api_token"              // gin context 里存 *model.APIToken 的 key
-	apiTokenLastUsedCtxKey  = "nz_api_token_used_marker"  // 标记是否需要异步更新 last_used
+	apiTokenCtxKey          = "nz_api_token"              // #nosec G101 -- gin context key name, not a credential
+	apiTokenLastUsedCtxKey  = "nz_api_token_used_marker"  // #nosec G101 -- gin context key name, not a credential
 	apiTokenAuthSchemePrefix = "Bearer "
 )
 

model/api_token.go

@@ -64,7 +64,7 @@ const (
 	ScopeNotificationDelete = "nezha:notification:delete"
 
 	ScopeNotificationGroupRead   = "nezha:notification-group:read"
-	ScopeNotificationGroupWrite  = "nezha:notification-group:write"
+	ScopeNotificationGroupWrite  = "nezha:notification-group:write" // #nosec G101 -- scope identifier, not a credential
 	ScopeNotificationGroupDelete = "nezha:notification-group:delete"
 
 	ScopeTransferRead   = "nezha:transfer:read"