fix(ops): restore bundled Zipkin tracing transport

[seonghobae]

Purpose

Fix #166 test-first. Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 bundled openzipkin/zipkin:2 as if its HTTP collector listened on container port 9412. The upstream image documents port 9411, while ETL, CDC, and gateway targeted zipkin:9412, so the default distributed-tracing transport was not defensible.

Status: active_pr; this is not shipped truth until protected integration.

Exact candidate

• Base: develop@622e5e6c3d534f230c390f10e3832efadfc01825
• Current source head: 82228115235edffbb37ef3fb662d60acf84ddb6e
• Two auditable commits: test-only RED 8bf04b1a57e4c74d49bf880a52c2b16c7276f7f0, then smallest GREEN production correction 82228115235edffbb37ef3fb662d60acf84ddb6e.
• Current diff is limited to docker-compose.yml plus DockerComposeZipkinTransportTest.

RED → GREEN evidence

The test-only head reached the intended shipped Compose boundary in hosted CI and failed because 9412:9411 was absent. It was not an import/fixture/setup failure.

The current candidate changes only the bundled Compose topology:

• historical host compatibility port stays 9412, but forwards to Zipkin container port 9411 (9412:9411);
• ETL, CDC, and gateway receive Spring externalized Compose overrides MANAGEMENT_ZIPKIN_TRACING_ENDPOINT=http://zipkin:9411/api/v2/spans;
• ordinary non-Compose application configuration remains separately externalizable.

Current CI run 31336585539 is GREEN on macOS, Windows, and Ubuntu. On macOS job 93303341090, DockerComposeZipkinTransportTest ran at the product topology boundary and passed; the full Maven reactor completed successfully. The workflow checked out GitHub synthetic merge a9169f87fad964952ac73d4dac914f7ad5e82aa0 (Merge 8222811... into 622e5e6...), not literal source head, so this is useful merged-tree proof but is not promoted to literal-head acceptance evidence.

Dependency Review 31336585553, CycloneDX SBOM 31336585533, and SAST Semgrep 31336585566 are GREEN on the current PR event.

Current non-passing gate RCA

Security Scan 31336585531 is FAILED solely in Trivy filesystem job 93303341065. The scan completed successfully and reported the six already-known protected-base Jackson findings in etl-service/pom.xml / root dependency resolution: CVE-2026-54515, CVE-2026-59889, and GHSA-mhm7-754m-9p8w. This PR changes no Maven dependency or Java production source. Shared remediation is already owned by PR #160; duplicating that POM change here or weakening/suppressing Trivy would create competing work rather than fix the root cause.

Classification: defer_until_trigger for this exact security gate until #160 integrates (or protected develop otherwise contains the accepted Jackson remediation), then rebase-free revalidation/replacement from the new protected base must regenerate evidence. Stacking this PR on #160 is also rejected while #160 has not satisfied progression governance.

Separately, protected-base JaCoCo still logs Analyzed bundle 'etl-service' with 0 classes; #162/#164 own the non-vacuous coverage control. This YAML/test-only slice does not claim that the inherited vacuous gate is acquisition-grade coverage evidence.

Review / merge boundary

CodeRabbit skipped review because this PR remains Draft. No qualifying formal approval exists. Do not mark ready/merge merely because functional CI is green: Security Scan is genuinely non-passing, literal-source execution controls remain separate, the inherited coverage gate is not acceptable evidence, and old-head/base checks or reviews do not transfer.

No secret, fake collector, tracing disablement, security suppression, gate weakening, cross-repository write, force push, or destructive history rewrite is used.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e0097d4a-847f-466f-9acf-101e94583907

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}