You can open this sample inside an IDE using the IntelliJ native importer or Eclipse Buildship.

This sample shows how credentials can be used when publishing artifacts to a Maven repository using project properties. This approach allows you to keep sensitive configuration out of your project’s source code and inject it only when needed.

The code in the maven-repository-stub directory builds a plugin used to stub the Maven repository in order to demonstrate the authentication flow. It expects the following hardcoded credentials on the server stub:

maven-repository-stub/src/main/java/com/example/MavenRepositoryStub.java
    private static final String USERNAME = "secret-user";
    private static final String PASSWORD = "secret-password";

In a real project, your build would point to a private repository for your organization.

The published project has some sample Java code to be compiled and distributed as a Java library. Gradle build file registers a publication to a Maven repository:

build.gradle
publishing {
    publications {
        library(MavenPublication) {
            from components.java
        }
    }
    repositories {
        maven {
            name = 'mySecure'
            // url = uri(<<some repository url>>)
        }
    }
}
build.gradle.kts
publishing {
    publications {
        create<MavenPublication>("library") {
            from(components.getByName("java"))
        }
    }
    repositories {
        maven {
            name = "mySecure"
            // url = uri(<<some repository url>>)
        }
    }
}

Authentication credentials are only configured and validated if the publication task is going to be invoked in the current build:

build.gradle
gradle.taskGraph.whenReady { taskGraph ->
    if (taskGraph.allTasks.any { it.name == 'publishLibraryPublicationToMySecureRepository' }) {
        def MAVEN_USERNAME_PROPERTY = 'mavenUser'
        def MAVEN_PASSWORD_PROPERTY = 'mavenPassword'
        def mavenUser = providers.gradleProperty(MAVEN_USERNAME_PROPERTY)
        def mavenPassword = providers.gradleProperty(MAVEN_PASSWORD_PROPERTY)
        if (!mavenUser.present || !mavenPassword.present) {
            throw new GradleException("Publishing requires '$MAVEN_USERNAME_PROPERTY' and '$MAVEN_PASSWORD_PROPERTY' properties")
        }
        publishing.repositories.named('mySecure') {
            credentials {
                username = mavenUser.get()
                password = mavenPassword.get()
            }
        }
    }
}
build.gradle.kts
gradle.taskGraph.whenReady {
    if (allTasks.any { it.name == "publishLibraryPublicationToMySecureRepository" }) {
        val MAVEN_USERNAME_PROPERTY = "mavenUser"
        val MAVEN_PASSWORD_PROPERTY = "mavenPassword"
        val mavenUser = providers.gradleProperty(MAVEN_USERNAME_PROPERTY)
        val mavenPassword = providers.gradleProperty(MAVEN_PASSWORD_PROPERTY)
        if (!mavenUser.isPresent || !mavenPassword.isPresent) {
            throw GradleException("Publishing requires '$MAVEN_USERNAME_PROPERTY' and '$MAVEN_PASSWORD_PROPERTY' properties")
        }
        publishing.repositories.named<MavenArtifactRepository>("mySecure") {
            credentials {
                username = mavenUser.get()
                password = mavenPassword.get()
            }
        }
    }
}

Credential values are declared to be Gradle properties and can be passed to the publish task in multiple ways:

  • via command-line properties:

$ ./gradlew publish -PmavenUser=secret-user -PmavenPassword=secret-password
  • via environment variables:

$ ORG_GRADLE_PROJECT_mavenUser=secret-user ORG_GRADLE_PROJECT_mavenPassword=secret-password ./gradlew publish
  • by setting the properties in gradle.properties file:

mavenUser=secret-user
mavenPassword=secret-password

and running

$ ./gradlew publish

The sensitive data is kept outside of the project sources since the gradle.properties file can reside in the user’s ~/.gradle directory.

For more information about using Gradle properties, see Gradle Properties user manual chapter.