[agent] HONEYCOMB_API_KEY never reaches the api-key sample bundle, making update-dependencies step 2d a no-op #214

Problem

The Update dependencies workflow sets HONEYCOMB_API_KEY: "ci-dummy-key" as a process environment variable so that the honeycomb/api-key sample app can start without crashing:

https://github.com/workleap/wl-telemetry/blob/main/.github/workflows/update-dependencies.yml#L69-L71

But that value never reaches the bundle. samples/honeycomb/api-key/app/rsbuild.dev.ts injects only the variables parsed out of .env files:

const { parsed } = loadEnv({
    cwd: path.resolve("../../../..")
});

export default defineDevConfig({
    environmentVariables: parsed
});

loadEnv().parsed contains only what was read from .env* files — it does not include process.env. There is no .env file at the repo root, so parsed is {} and process.env.HONEYCOMB_API_KEY compiles to undefined in the app bundle.

Verified on this runner:

$ node -e "... loadEnv({ cwd: repoRoot }) ..."
parsed keys: []
HONEYCOMB_API_KEY in parsed: undefined
HONEYCOMB_API_KEY in process.env: true

Impact

Step 2d of .github/prompts/update-dependencies.md does not actually validate the sample app. registerHoneycombInstrumentation throws during module evaluation:

Uncaught Error: [honeycomb] Instrumentation must be initialized with either a "proxy" or "apiKey" option.
    at getHoneycombSdkOptions (http://localhost:8080/static/js/index.js:504:15)
    at HoneycombInstrumentationRegistrator.register (...)
    at registerHoneycombInstrumentation (...)
    at ./src/index.tsx (...)

React never renders, so <div id="root"> stays empty and agent-browser snapshot returns (empty page).

This failure is silent for the agent following the prompt: the crash is an uncaught exception, not a console.* call, so agent-browser console reports no errors at all. An agent that checks the console (as the prompt instructs) sees a clean run against a completely blank app.

Suggested fix

Either have the workflow write a root .env file instead of exporting a process variable:

- name: Create .env for sample apps
  run: echo "HONEYCOMB_API_KEY=ci-dummy-key" > .env

…or have rsbuild.dev.ts fall back to process.env:

environmentVariables: { ...parsed, HONEYCOMB_API_KEY: process.env.HONEYCOMB_API_KEY ?? parsed.HONEYCOMB_API_KEY }

It would also be worth strengthening step 2d in .github/prompts/update-dependencies.md to assert that the snapshot is non-empty, so a blank page can never be mistaken for a pass.

Notes

Found while running the weekly dependency update (see #212 and the PR it accompanies). For that run I worked around it locally with a temporary, gitignored root .env.local; with the key actually injected, all three pages (/, /movies, /subscription) rendered correctly with no unexpected console errors. The temporary file was removed and is not part of the PR.

Workflow run

https://github.com/workleap/wl-telemetry/actions/runs/32146844425