Authenticated Repositories

## The problem A *private* artifact repository (a company Artifactory, Nexus, GitHub Packages, etc.) refuses anonymous reads. Gradle must present credentials when it resolves dependencies from that repo. The naive approach — typing the password into `build.gradle.kts` — leaks the secret into source control. Gradle gives you a structured way to supply credentials *and* a convention for sourcing them from outside the build. ## Two ways to attach credentials **1. Inline credentials block** — you set the values yourself: ```kotlin repositories { maven { url = uri("https://repo.example.com/private") credentials { username = providers.gradleProperty("repoUser").get() password = providers.gradleProperty("repoPassword").get() } } } ``` **2. Typed credentials with the naming convention** — `credentials(PasswordCredentials::class)` tells Gradle to look up `<repoName>Username` and `<repoName>Password` automatically: ```kotlin repositories { maven { name = "mavenPrivate" url = uri("https://repo.example.com/private") credentials(PasswordCredentials::class) } } ``` With the repo named `mavenPrivate`, Gradle resolves `mavenPrivateUsername` / `mavenPrivatePassword`. ## Where the values come from Gradle properties resolve from (highest precedence first): `-PmavenPrivateUsername=...` on the command line, the `ORG_GRADLE_PROJECT_mavenPrivateUsername` environment variable, `~/.gradle/gradle.properties` (per-user, NOT in the repo), then the project's `gradle.properties`. For secrets you want the *user-home* gradle.properties or the env var, never the project file. ## Why the convention matters With `credentials(PasswordCredentials::class)` and a per-user gradle.properties, the same build script works for every developer and for CI without any secret appearing in the repo. CI typically injects them as `ORG_GRADLE_PROJECT_*` env vars from its secret store.