Best practices with passing a GitHub secret to a Gradle task in a workflow

Help/Discuss
1

Hi,

I am creating a workflow executes gradle tasks.
It looks similar to this.

name: My Workflow

on:
  push:
    branches: [main]

env:
  USERNAME: myUserName

jobs:
  my-job:
    runs-on: [self-hosted]
    steps:
      - name: Checkout project sources
        uses: actions/checkout@v3

      - name: Call my Gradle Task
        run: .\gradlew :myGradleTaskName -DMY_PASSWORD=${{secrets.PASSWORD}}

I would like to know the best practice when it comes to passing the secret to my gradle task.

(This question is mostly related to GitHub than Gradle. But posting it here just in case someone here might know the best approach)

I did a search on the internet on the best practice and there are contradicting answers!
Please help me out here.

2

I’d say there are contradicting answers, as there is no “correct” answer. It depends on many factors which method might or might not be preferable.