[XuPeng-SH]

Do not merge: the ARM candidate failed the resource and latency acceptance criteria below. The resource limits are being reconsidered.

Problem

Related to matrixorigin/matrixone#31428. An ARM64 SCA runner with an 8 GiB cgroup limit was OOM-killed on PR #31420. Its original logs did not establish which process or phase caused the incident. The same source on the same runner class later completed a full scan with its cgroup peak at 8 GiB and 13 memory.max events; this peak includes reclaimable file cache and is not process RSS.

Change

• Scope GOFLAGS=-p=1 and a default GOMEMLIMIT=5GiB to the existing SCA make invocation, including its legacy fallback. Preserve pre-existing GOFLAGS and an explicit GOMEMLIMIT. The memory target is soft and per Go process; it is not a container-wide cap.
• Restore the existing incremental license-header and dependency scope for the exact, independently full-scanned current license config and recipe on canonical matrixorigin/matrixone main. Unknown base, config, recipe, or missing path information retains full checks.

No analyzer or test selection is removed. Serial package actions may increase analysis elapsed time; the incident's exact original allocation cause remains unverified.

Validation

• node --test actions/resolve-sca-license-scope/scope.test.js: 22 passed.
• Workflow-shell integration probe: 11 cases, including known and unknown config/recipe, canonical and other base, missing scope, preserved GOFLAGS/GOMEMLIMIT, legacy target and error propagation.
• actionlint v1.7.12 and git diff --check passed. Go source is unchanged; Go UT race is not applicable to this CI-only delta.
• Full header/license scan passed on current main inputs, including the subsequent main changes in #31284 and #31321.
• Independent gpt-6.1-terra/max review of the complete functional diff found no remaining confirmed code defect.
• ARM64 full-scan control 40489038493 versus tuned candidate 40496244705, same incident source and matched observed module, lint, tool, native and ONNX cache states: both completed. Baseline make elapsed 2253.765s; tuned 3270.633s (+1016.868s, about 17 min). The 8 GiB cgroup lifetime peaks were 8589934592 and 8589930496 bytes; memory.events max were 13 and 1, with no OOM kill in either run. This does not demonstrate useful cgroup headroom. golangci Go runtime memory max fell from 7856.7 MB to 5749.4 MB, but that is neither process RSS nor total container memory.
• The resource-limited candidate is not accepted: it adds substantial elapsed time and still nearly reaches the cgroup ceiling. The incident’s original killed process is unknown.

The separately discovered molint diagnostic-protocol defect is tracked in matrixorigin/matrixone#31455; a successful run with the old tool is not proof that molint had no findings.

[XuPeng-SH]

Closing this candidate: the global resource limits increased ARM SCA time substantially without demonstrating sufficient cgroup headroom, and enabling incremental license checks for the current configuration can miss files from changes that bypass SCA. The remaining dependency-only optimization saves approximately two seconds and does not justify its complexity. MatrixOne issue #31428 remains open for further investigation; this PR does not establish the original OOM root cause or fix it.