feat(telemetry): OTel plumbing

[fabriziosestito]

Description

Introduces the shared OpenTelemetry bootstrap for the four sbomscanner binaries, gated on OTEL_EXPORTER_OTLP_ENDPOINT.

When the variable is unset, the binaries install no-op providers and behave exactly as before; when it is set, traces and metrics are exported over OTLP/gRPC to any collector the operator provides.
All runtime configuration is done via the standard OpenTelemetry environment variables; no new CLI flags are introduced.

The new internal/telemetry package holds the Setup entry point, an slog.Handler wrapper that decorates log records with the active trace_id and span_id for log-to-trace correlation, a TextMapCarrier over NATS headers used by the messaging layer, and small Tracer / Meter helpers that expose the spec-conformant instrumentation scope.

Each cmd/*/main.go now calls telemetry.Setup right after slog init and defers a bounded shutdown.

Also, it adds build-time version injecitonm, which is used as metadata in the telemetry.

Fixes #1215

[codecov]

Codecov Report

❌ Patch coverage is 30.55556% with 200 lines in your changes missing coverage. Please review.
✅ Project coverage is 53.27%. Comparing base (1ebda86) to head (3842677).
⚠️ Report is 174 commits behind head on main.

Files with missing lines	Patch %	Lines
cmd/controller/main.go	0.00%	73 Missing ⚠️
cmd/worker/main.go	0.00%	62 Missing ⚠️
cmd/mcp/main.go	0.00%	35 Missing ⚠️
internal/telemetry/otel.go	76.36%	9 Missing and 4 partials ⚠️
cmd/storage/main.go	0.00%	9 Missing ⚠️
internal/telemetry/slog.go	72.72%	5 Missing and 1 partial ⚠️
internal/mcp/server.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1214      +/-   ##
==========================================
+ Coverage   52.85%   53.27%   +0.41%     
==========================================
  Files          77       81       +4     
  Lines        6472     6572     +100     
==========================================
+ Hits         3421     3501      +80     
- Misses       2576     2589      +13     
- Partials      475      482       +7     

Flag	Coverage Δ
unit-tests	53.27% <30.55%> (+0.41%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Adds foundational OpenTelemetry plumbing to sbomscanner so the four binaries can optionally export traces/metrics over OTLP/gRPC when OTEL_EXPORTER_OTLP_ENDPOINT is set, while remaining no-op otherwise. This introduces a shared internal/telemetry package, wires it into each binary’s startup/shutdown flow, and adds build-time version injection for telemetry metadata.

Changes:

• Introduce internal/telemetry with Setup, slog trace/span correlation handler, NATS header propagation carrier, and Tracer/Meter scope helpers.
• Wire telemetry setup + bounded shutdown into cmd/{controller,worker,storage,mcp}/main.go.
• Add internal/version and Dockerfile -ldflags injection to embed build version into binaries (used by telemetry scope/version metadata).

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/version/version.go	Adds an injectable build-version variable (Version) defaulting to dev.
internal/version/doc.go	Package doc for internal/version.
internal/telemetry/slog.go	Adds a slog.Handler wrapper to inject trace_id/span_id from context.
internal/telemetry/slog_test.go	Tests slog trace/span correlation behavior and wrapper semantics.
internal/telemetry/scope.go	Adds Tracer/Meter helpers with spec-conformant instrumentation scope names and version.
internal/telemetry/scope_test.go	Tests scope name formatting and non-nil tracer/meter helpers.
internal/telemetry/otel.go	Implements OTel bootstrap (Setup) gated on OTEL_EXPORTER_OTLP_ENDPOINT, with OTLP exporters and resources.
internal/telemetry/otel_test.go	Tests no-endpoint behavior (no-op shutdown + propagators installed).
internal/telemetry/nats.go	Adds a NATS header TextMapCarrier plus inject/extract helpers for propagation.
internal/telemetry/nats_test.go	Tests NATS header propagation round-trip and nil-safety.
internal/telemetry/doc.go	Package doc for internal/telemetry.
internal/mcp/server.go	Uses errors.Is for http.ErrServerClosed checks.
go.mod	Promotes OpenTelemetry modules to direct dependencies needed by new telemetry package.
Dockerfile.worker	Adds VERSION build arg and ldflags injection for embedded version.
Dockerfile.storage	Adds VERSION build arg and ldflags injection for embedded version.
Dockerfile.mcp	Adds VERSION build arg and ldflags injection for embedded version.
Dockerfile.controller	Adds VERSION build arg and ldflags injection for embedded version.
cmd/worker/main.go	Initializes telemetry on startup, wraps slog handler for trace/span correlation, and adds bounded shutdown.
cmd/storage/main.go	Initializes telemetry on startup, wraps slog handler for trace/span correlation, and adds bounded shutdown.
cmd/mcp/main.go	Initializes telemetry on startup, wraps slog handler for trace/span correlation, and adds bounded shutdown.
cmd/controller/main.go	Initializes telemetry on startup, wraps slog handler for trace/span correlation, and adds bounded shutdown earlier in boot sequence.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[flavio]

that's pretty neat 👏