The app service's environment block is an explicit allow-list, not
env_file — as the comment two lines above this change says, a var added
to .env but not listed here never reaches the container.
PR #20 added OIDC_OFFLINE_ACCESS to .env.example and documented it in the
README but missed this, so setting it in .env would have been silently
ignored and the refresh-token fix would not have taken effect. Caught
while deploying, before it could look like the IdP change had failed.
The external-db override merges its environment block rather than
replacing it, so it inherits this and needs no equivalent change.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
shadowdaoandClaude Opus 5