fix(tracing): persist trimmed endpoint and treat null/nil baggage as empty

[gandalf-at-lerian]

Summary

Applies two approved CodeRabbit review fixes from PR #19.

Fix #1 — tracing/otel.go · normalizeEndpoint

In the default (no-scheme) branch, the trimmed endpoint value (ep) was only held in a local variable; cfg.CollectorExporterEndpoint retained the original value with surrounding whitespace. Now persists the trimmed value back into the config.

Fix #2 — tracing/processor.go · sanitizeTenantFromBaggage

Treats literal "null" / "nil" (case-insensitive, via strings.EqualFold) as empty, mirroring the middleware tenant-sanitization path and preventing JSON-null serialization artifacts from leaking into span tenant.id.

Verification

• go build ./... — OK
• go test -tags unit ./... — all packages pass

References

Addresses CodeRabbit review comments on PR #19.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 67d28a2e-0418-4e77-8500-3a34db630262

📥 Commits

Reviewing files that changed from the base of the PR and between 2428e19 and 44797f6.

📒 Files selected for processing (2)

• tracing/otel.go
• tracing/processor.go

---

Walkthrough

Two defensive fixes in the tracing package: normalizeEndpoint in otel.go now writes the whitespace-trimmed endpoint back to cfg.CollectorExporterEndpoint for the no-scheme case, and sanitizeTenantFromBaggage in processor.go adds a case-insensitive check that treats literal "null" or "nil" baggage values as empty strings.

Changes

Tracing Input Sanitization

Layer / File(s)	Summary
Persist trimmed endpoint back to config tracing/otel.go	In the no-scheme path of normalizeEndpoint, the locally trimmed ep value is now assigned back to cfg.CollectorExporterEndpoint, ensuring the config struct reflects the whitespace-stripped value.
Normalize null/nil baggage values to empty string tracing/processor.go	sanitizeTenantFromBaggage adds a guard before the existing length checks: if the baggage value is the literal string "null" or "nil" (case-insensitive), it returns "" immediately, preventing JSON null serialization artifacts from propagating as a tenant.id span attribute.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[lerian-studio]

🔒 Security Scan Results — lib-observability

✅ PR Mergeable — no blocking findings

Stage	Status	Blocking?
Filesystem Scan	✅ Clean	—
Docker Image Scan	➖ Skipped	—
Docker Hub Health Score	➖ Skipped	—
Pre-release Version Check	✅ Clean	—

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

---

Pre-release Version Check

✅ No unstable version pins found.

---

_{🔍 View full scan logs}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

📊 Unit Test Coverage Report: lib-observability

Metric	Value
Overall Coverage	85.7% ✅ PASS
Threshold	80%

Coverage by Package

Package	Coverage
github.com/LerianStudio/lib-observability/assert	97.9%
github.com/LerianStudio/lib-observability/constants	83.3%
github.com/LerianStudio/lib-observability/log	94.9%
github.com/LerianStudio/lib-observability/metrics	91.4%
github.com/LerianStudio/lib-observability/middleware	76.9%
github.com/LerianStudio/lib-observability/redaction	95.8%
github.com/LerianStudio/lib-observability/runtime	80.4%
github.com/LerianStudio/lib-observability/tracing	84.8%
github.com/LerianStudio/lib-observability/zap	96.0%
github.com/LerianStudio/lib-observability	91.5%

---

Generated by Go PR Analysis workflow