Merge pull request 'fix: fix: env.sh should not source .env inside containers — compose env is the source of truth (#378)' (#395) from fix/issue-378 into main

lib/env.sh

@@ -20,12 +20,10 @@ fi
 export DISINTO_LOG_DIR
 
 # Load secrets: prefer .env.enc (SOPS-encrypted), fall back to plaintext .env.
-# Always source .env — cron jobs inside the container do NOT inherit compose
-# env vars (FORGE_TOKEN, etc.). Only FORGE_URL is preserved across .env
-# sourcing because compose injects http://forgejo:3000 while .env has
-# http://localhost:3000. FORGE_TOKEN is NOT preserved so that refreshed
-# tokens in .env take effect immediately in running containers.
-if [ -f "$FACTORY_ROOT/.env.enc" ] && command -v sops &>/dev/null; then
+# Inside containers (DISINTO_CONTAINER=1), compose environment is the source of truth.
+# On bare metal, .env/.env.enc is sourced to provide default values.
+if [ "${DISINTO_CONTAINER:-}" != "1" ]; then
+  if [ -f "$FACTORY_ROOT/.env.enc" ] && command -v sops &>/dev/null; then
     set -a
     _saved_forge_url="${FORGE_URL:-}"
     # Use temp file + validate dotenv format before sourcing (avoids eval injection)
@@ -54,7 +52,7 @@ if [ -f "$FACTORY_ROOT/.env.enc" ] && command -v sops &>/dev/null; then
     rm -f "$_tmpenv"
     set +a
     [ -n "$_saved_forge_url" ] && export FORGE_URL="$_saved_forge_url"
-elif [ -f "$FACTORY_ROOT/.env" ]; then
+  elif [ -f "$FACTORY_ROOT/.env" ]; then
     # Preserve compose-injected FORGE_URL (localhost in .env != forgejo in Docker)
     _saved_forge_url="${FORGE_URL:-}"
     set -a
@@ -62,6 +60,7 @@ elif [ -f "$FACTORY_ROOT/.env" ]; then
     source "$FACTORY_ROOT/.env"
     set +a
     [ -n "$_saved_forge_url" ] && export FORGE_URL="$_saved_forge_url"
+  fi
 fi
 
 # Allow per-container token override (#375): .env sets the default FORGE_TOKEN