fix: resolve remaining lint and gosec issues

- goconst: extract "gpu" to kindGPU constant
- prealloc: preallocate volumes and volDetails slices
- revive: suppress var-naming for cmd/util package
- nolintlint: suppress for gosec directives (needed by separate security CI)
- gosec G304: add nolint to all os.ReadFile on controlled config paths

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hi-lei

.golangci.yaml

@@ -91,6 +91,13 @@ linters:
       - path: cmd/
         linters:
           - unparam
+      - path: cmd/util/
+        linters:
+          - revive
+        text: "var-naming"
+      - linters:
+          - nolintlint
+        text: "gosec"
 
 formatters:
   enable:

internal/verda-cli/cmd/auth/auth_test.go

@@ -16,7 +16,7 @@ func TestWriteActiveProfile(t *testing.T) {
 		t.Fatalf("writeActiveProfile() returned error: %v", err)
 	}
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // test file
 	if err != nil {
 		t.Fatalf("os.ReadFile() returned error: %v", err)
 	}

internal/verda-cli/cmd/auth/use.go

@@ -51,7 +51,7 @@ func NewCmdUse(_ cmdutil.Factory, ioStreams cmdutil.IOStreams) *cobra.Command {
 
 func writeActiveProfile(path, profile string) error {
 	cfg := map[string]any{}
-	if data, err := os.ReadFile(path); err == nil {
+	if data, err := os.ReadFile(path); err == nil { //nolint:gosec // controlled config path
 		if err := yaml.Unmarshal(data, &cfg); err != nil {
 			return err
 		}

internal/verda-cli/cmd/vm/list.go

@@ -120,7 +120,7 @@ func fetchInstanceVolumes(ctx context.Context, client *verda.Client, inst *verda
 		}
 	}
 
-	var volumes []verda.Volume
+	volumes := make([]verda.Volume, 0, len(ids))
 	for _, id := range ids {
 		vol, err := client.Volumes.GetVolume(ctx, id)
 		if err != nil {

internal/verda-cli/cmd/vm/wizard.go

@@ -18,7 +18,10 @@ import (
 	cmdutil "github/verda-cloud/verda-cli/internal/verda-cli/cmd/util"
 )
 
-const billingTypeSpot = "spot"
+const (
+	billingTypeSpot = "spot"
+	kindGPU         = "gpu"
+)
 
 // clientFunc lazily resolves a Verda API client. This allows the wizard
 // to start without credentials — steps that don't need API (billing-type,
@@ -184,7 +187,7 @@ func stepKind(opts *createOptions) wizard.Step {
 		Prompt:      wizard.SelectPrompt,
 		Required:    true,
 		Loader: wizard.StaticChoices(
-			wizard.Choice{Label: "GPU", Value: "gpu", Description: "GPU-accelerated instances"},
+			wizard.Choice{Label: "GPU", Value: kindGPU, Description: "GPU-accelerated instances"},
 			wizard.Choice{Label: "CPU", Value: "cpu", Description: "CPU-only instances"},
 		),
 		Setter:   func(v any) { opts.Kind = v.(string) },
@@ -1019,7 +1022,7 @@ func renderDeploymentSummary(opts *createOptions, cache *apiCache) {
 		unitPrice     float64 // per GB per month
 		hourly        float64
 	}
-	var volDetails []volDetail
+	volDetails := make([]volDetail, 0, len(opts.VolumeSpecs))
 	for _, spec := range opts.VolumeSpecs {
 		parts := strings.SplitN(spec, ":", 3)
 		if len(parts) < 3 {
@@ -1104,7 +1107,7 @@ func matchesKind(instanceType, kind string) bool {
 	switch strings.ToLower(kind) {
 	case "cpu":
 		return isCPU
-	case "gpu":
+	case kindGPU:
 		return !isCPU
 	default:
 		return true

internal/verda-cli/options/settings.go

@@ -17,7 +17,7 @@ func SaveSetting(key string, value any) error {
 	path := filepath.Join(dir, "config.yaml")
 
 	cfg := map[string]any{}
-	if data, err := os.ReadFile(path); err == nil {
+	if data, err := os.ReadFile(path); err == nil { //nolint:gosec // controlled config path
 		if err := yaml.Unmarshal(data, &cfg); err != nil {
 			return err
 		}
@@ -42,7 +42,7 @@ func GetSetting(key string) (any, bool) {
 	}
 	path := filepath.Join(dir, "config.yaml")
 
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) //nolint:gosec // controlled config path
 	if err != nil {
 		return nil, false
 	}