Where to put Gradle configuration (i.e. credentials) that should not be committed?

Question

I'm trying to deploy a Gradle-built artifact to a Maven repo, and I need to specify credentials for that. This works fine for now:

uploadArchives {
    repositories {
        mavenDeployer {
            repository(url: "http://.../nexus/content/repositories/snapshots/") {
                authentication(userName: "admin", password: "admin123")
            }
        }
    }
}

But I don't like having to store the credentials in source control. With Maven, I would define a server configuration, and assign credentials in my ~/.m2/settings.xml. How do I do something similar with Gradle?

Answer 1

~/.gradle/gradle.properties:

mavenUser=admin
mavenPassword=admin123

build.gradle:

...
authentication(userName: mavenUser, password: mavenPassword)

Answer 2

First answer is still valid, but the API has changed in the past. Since my edit there wasn't accepted I post it as separate answer.

The method authentication() is only used to provide the authentication method (e.g. Basic) but not any credentials.

You also shouldn't use it since it's printing the credentials plain on failure!

This his how it should look like in your build.gradle

    maven {
        credentials {
            username "$mavenUser"
            password "$mavenPassword"
        }
        url 'https://maven.yourcorp.net/'
   }

In gradle.properties in your userhome dir put:

mavenUser=admin
mavenPassword=admin123

Also ensure that the GRADLE_USER_HOME is set to ~/.gradle otherwise the properties file there won't be resolved.

See also:

https://docs.gradle.org/current/userguide/build_environment.html

and

https://docs.gradle.org/current/userguide/dependency_management.html (23.6.4.1)

Answer 3

If you have user specific credentials ( i.e each developer might have different username/password ) then I would recommend using the gradle-properties-plugin.

1. Put defaults in gradle.properties
2. Each developer overrides with gradle-local.properties ( this should be git ignored ).

This is better than overriding using $USER_HOME/.gradle/gradle.properties because different projects might have same property names.

Note that the plugin actually adds gradle-${environment}.properties where the default for ${environment} is local, and has additional features. Read the link before using it.

Answer 4

You could also supply variables on the command line with -PmavenUser=user -PmavenPassword=password.

This might be useful you can't use a gradle.properties file for some reason. E.g. on a build server we're using Gradle with the -g option so that each build plan has it's own GRADLE_HOME.

Answer 5

You could put the credentials in a properties file and read it using something like this:

Properties props = new Properties() 
props.load(new FileInputStream("yourPath/credentials.properties")) 
project.setProperty('props', props)

Another approach is to define environment variables at the OS level and read them using:

System.getenv()['YOUR_ENV_VARIABLE']

Answer 6

For those of you who are building on a MacOS, and don't like leaving your password in clear text on your machine, you can use the keychain tool to store the credentials and then inject it into the build. Credits go to Viktor Eriksson. https://pilloxa.gitlab.io/posts/safer-passwords-in-gradle/

Answer 7

build.gradle

apply from: "./build.gradle.local"
... 
authentication(userName: project.ext.mavenUserName, password: project.ext.mavenPassword)

build.gradle.local (git ignored)

project.ext.mavenUserName="admin"
project.ext.mavenPassword="admin123"

Answer 8

As per the 7.1.1 gradle document, we have the syntax for setting repositories with credentials as below, the below code snippet should be in build.gradle file of the project

repositories {
maven {
    url "http://repo.mycompany.com"
    credentials {
        username "user"
        password "password"
    }
}

The above is to showcase the syntax changes in the gradle 7.x.x This can be altered to make password as a variable as shown in the approved solution above.