fix(ci): pass server build secrets to nightly staging steps

[Nikhil (shadowfax92)]

Nightlies have shipped browseros_server with the https://browseros.invalid/... placeholder config URL since the per-product nightlies began staging the server locally with bun scripts/build/server.ts --ci (~Jul 6-8): the staging steps never passed REQUIRED_PROD_VARS (scripts/build/server/descriptor.ts), so the --ci placeholder defaults got inlined into the binary. Result: the default browseros provider and credits endpoints cannot connect in nightly builds (BYO-key providers unaffected). PostHog/Sentry are placeholder too.

Mirrors release-server.yml: pass BROWSEROS_CONFIG_URL, POSTHOG_API_KEY, SENTRY_DSN, AGENT_RUNNER_JWT_SECRET (all existing repo secrets) to both nightly staging steps.

Found while validating the chromium-151 nightly (#1900) — verified fixed by re-running the nightly on that branch with this change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TZ3u9Dc57DL56JCsZy8uCg

[greptile-apps]

Greptile Summary

This PR fixes nightly builds of browseros_server that have been shipping with browseros.invalid placeholder config URLs since the per-product nightly staging steps began invoking bun scripts/build/server.ts --ci locally. The --ci flag inlines REQUIRED_PROD_VARS at compile time, but neither nightly staging step was passing those secrets, so every shipped binary carried non-functional endpoints.

• Adds BROWSEROS_CONFIG_URL, POSTHOG_API_KEY, SENTRY_DSN, and AGENT_RUNNER_JWT_SECRET to the Stage BrowserOS nightly resources env block in nightly-browseros.yml, exactly mirroring the release-server.yml build job.
• Applies the same four secrets to the equivalent staging step in nightly-browserclaw.yml, which also invokes server.ts --ci for the bundled browseros-server binary.

Confidence Score: 5/5

Safe to merge — minimal, targeted CI-only change that restores correct secret injection into nightly server builds.

Both changed files add the same four secrets that release-server.yml already passes to the equivalent build step. The set of secrets added exactly matches the REQUIRED_PROD_VARS described in descriptor.ts, no application logic is touched, and the PR author confirmed the fix by re-running the nightly on the chromium-151 branch.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/nightly-browseros.yml	Adds the four compile-time server build secrets to the Stage BrowserOS nightly resources step env block, matching the release-server.yml pattern.
.github/workflows/nightly-browserclaw.yml	Adds the same four compile-time server build secrets to the Stage BrowserClaw nightly resources step, which also calls server.ts --ci.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant GH as GitHub Actions
    participant Step as Stage Nightly Resources
    participant ServerBuild as server.ts --ci
    participant Binary as browseros_server binary

    GH->>Step: "env: BROWSEROS_CONFIG_URL, POSTHOG_API_KEY,<br/>SENTRY_DSN, AGENT_RUNNER_JWT_SECRET"
    Step->>ServerBuild: "bun scripts/build/server.ts --target=darwin-arm64 --ci"
    Note over ServerBuild: Reads REQUIRED_PROD_VARS<br/>from environment
    ServerBuild-->>Binary: Inlines real config URL + keys
    Note over Binary: Before this fix: browseros.invalid<br/>placeholders were inlined instead

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant GH as GitHub Actions
    participant Step as Stage Nightly Resources
    participant ServerBuild as server.ts --ci
    participant Binary as browseros_server binary

    GH->>Step: "env: BROWSEROS_CONFIG_URL, POSTHOG_API_KEY,<br/>SENTRY_DSN, AGENT_RUNNER_JWT_SECRET"
    Step->>ServerBuild: "bun scripts/build/server.ts --target=darwin-arm64 --ci"
    Note over ServerBuild: Reads REQUIRED_PROD_VARS<br/>from environment
    ServerBuild-->>Binary: Inlines real config URL + keys
    Note over Binary: Before this fix: browseros.invalid<br/>placeholders were inlined instead

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): pass server build secrets to ni..." | Re-trigger Greptile}