Harden OMNL dotenv layering and local health

scripts/lib/deployment/dotenv.sh

@@ -27,6 +27,34 @@ _dep_dotenv_source() {
   (( had_nounset )) && set -u
 }
 
+_dep_dotenv_defaults() {
+  local f="$1"
+  [[ -f "$f" ]] || return 0
+  local had_nounset=0 line key value
+  if [[ $- == *u* ]]; then
+    had_nounset=1
+    set +u
+  fi
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    line="${line//$'\r'/}"
+    [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue
+    [[ "$line" == export\ * ]] && line="${line#export }"
+    [[ "$line" == *=* ]] || continue
+    key="${line%%=*}"
+    value="${line#*=}"
+    [[ "$key" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]] || continue
+    [[ -n "${!key:-}" ]] && continue
+    value="${value%$'\n'}"
+    if [[ "$value" =~ ^\".*\"$ ]]; then
+      value="${value:1:${#value}-2}"
+    elif [[ "$value" =~ ^\'.*\'$ ]]; then
+      value="${value:1:${#value}-2}"
+    fi
+    export "$key=$value"
+  done < "$f"
+  (( had_nounset )) && set -u
+}
+
 _dep_export_from_private_key() {
   [[ -n "${DEPLOYER_ADDRESS:-}" || -z "${PRIVATE_KEY:-}" ]] && return 0
   command -v cast >/dev/null 2>&1 || return 0
@@ -97,7 +125,7 @@ load_deployment_env() {
   [[ -n "${ENV_FILE:-}" && -f "${ENV_FILE}" ]] && dotenv="${ENV_FILE}"
   _dep_dotenv_source "$dotenv"
   if [[ -z "${ENV_FILE:-}" ]]; then
-    _dep_dotenv_source "${root}/smom-dbis-138/.env"
+    _dep_dotenv_defaults "${root}/smom-dbis-138/.env"
   fi
   local secure_secrets_file="${SECURE_SECRETS_FILE:-$HOME/.secure-secrets/private-keys.env}"
   if [[ -f "$secure_secrets_file" ]]; then