feat: implement local .env and setenv.sh setup to make environment configuration resilient

[jeffonelson]

No description provided.

[gemini-code-assist]

Code Review

This pull request introduces environment variable management using a .env file across several setup scripts (setenv.sh, setup_alloydb.sh, and setup_lab.sh). While this improves configuration persistence, the current method of loading variables using export $(grep -v '^#' ... | xargs) has critical flaws. It can leak sensitive environment variables if the .env file is empty, cause shell crashes under strict error-handling settings (set -e / pipefail), and fail to parse values containing spaces. It is highly recommended to replace this pattern with a robust while read loop as suggested in the feedback.

[gemini-code-assist]

Using export $(grep -v '^#' "$ENV_FILE" | xargs) has several critical issues:

1. Information Disclosure / Leakage: If the .env file is empty or only contains comments, grep will produce no output. Running export with no arguments in Bash prints all exported environment variables, which can leak sensitive credentials or tokens to the console/build logs.
2. Shell Crashes: If the calling shell has set -e and set -o pipefail enabled, sourcing this script will cause the shell to exit immediately if grep returns a non-zero exit code (which happens when no matches are found, e.g., an empty or comment-only file).
3. Handling Spaces: This pattern splits on whitespace, which will break if any environment variable value contains spaces.

Using a while read loop is much safer, robust, and handles spaces and empty files correctly without crashing.

Suggested change

	if [ -f "$ENV_FILE" ]; then
	echo "Loading environment variables from $ENV_FILE..."
	# Export all non-commented variables from the .env file cleanly
	export $(grep -v '^#' "$ENV_FILE" | xargs)
	if [ -f "$ENV_FILE" ]; then
	echo "Loading environment variables from $ENV_FILE..."
	while IFS= read -r line || [[ -n "$line" ]]; do
	[[ "$line" =~ ^[[:space:]]*# || -z "$line" ]] && continue
	export "$line"
	done < "$ENV_FILE"
	fi

[gemini-code-assist]

Using export $(grep -v '^#' "$ENV_FILE" | xargs) has several critical issues:

1. Information Disclosure / Leakage: If the .env file is empty or only contains comments, grep will produce no output. Running export with no arguments in Bash prints all exported environment variables, which can leak sensitive credentials or tokens to the console/build logs.
2. Shell Crashes: Since set -e is enabled in this script, if grep returns a non-zero exit code (which happens when no matches are found, e.g., an empty or comment-only file), the script may crash depending on shell settings.
3. Handling Spaces: This pattern splits on whitespace, which will break if any environment variable value contains spaces.

Using a while read loop is much safer, robust, and handles spaces and empty files correctly without crashing.

Suggested change

	if [ -f "$ENV_FILE" ]; then
	echo "Found existing environment file: $ENV_FILE"
	export $(grep -v '^#' "$ENV_FILE" | xargs)
	fi
	if [ -f "$ENV_FILE" ]; then
	echo "Found existing environment file: $ENV_FILE"
	while IFS= read -r line || [[ -n "$line" ]]; do
	[[ "$line" =~ ^[[:space:]]*# || -z "$line" ]] && continue
	export "$line"
	done < "$ENV_FILE"
	fi

[gemini-code-assist]

Using export $(grep -v '^#' "$ENV_FILE" | xargs) has several critical issues:

1. Information Disclosure / Leakage: If the .env file is empty or only contains comments, grep will produce no output. Running export with no arguments in Bash prints all exported environment variables, which can leak sensitive credentials or tokens to the console/build logs.
2. Shell Crashes: Since set -euo pipefail is enabled in this script, if grep returns a non-zero exit code (which happens when no matches are found, e.g., an empty or comment-only file), the pipeline will fail and the script will crash immediately.
3. Handling Spaces: This pattern splits on whitespace, which will break if any environment variable value contains spaces.

Using a while read loop is much safer, robust, and handles spaces and empty files correctly without crashing.

Suggested change

	if [ -f "$ENV_FILE" ]; then
	echo "Loading environment variables from $ENV_FILE..."
	export $(grep -v '^#' "$ENV_FILE" | xargs)
	fi
	if [ -f "$ENV_FILE" ]; then
	echo "Loading environment variables from $ENV_FILE..."
	while IFS= read -r line || [[ -n "$line" ]]; do
	[[ "$line" =~ ^[[:space:]]*# || -z "$line" ]] && continue
	export "$line"
	done < "$ENV_FILE"
	fi