How do you secure credentials used in a Gradle build?

Credentials (repository publishing tokens, private repository access keys, signing keys) need to stay out of committed build scripts, and Gradle provides a few standard mechanisms rather than hardcoding secrets inline.

• Gradle properties in the user home directory (~/.gradle/gradle.properties), which isn't checked into the repository, referenced from the build script by property name.
• Environment variables, read via providers.environmentVariable('TOKEN'), which is the standard approach for CI systems that inject secrets as env vars.
• Credentials providers on repository declarations — Gradle's PasswordCredentials/credentials {} block on a maven { } repository reads from properties or environment without the values ever appearing in the script text itself.

repositories {
    maven {
        url = uri('https://repo.example.com/releases')
        credentials {
            username = providers.gradleProperty('repoUser').get()
            password = providers.gradleProperty('repoPassword').get()
        }
    }
}

The consistent principle across all of these: the build script references where to find a credential, never the credential value itself, so the script stays safe to commit even though the actual secret lives outside version control entirely.