/gradlew :appA:decryptSecretsData -Pkey=$APPA_SECRETS_KEY
./gradlew :appB:decryptSecretsData -Pkey=$APPB_SECRETS_KEY

currently on CI I need to decrypt secrets per app (its a convention plugin applied to each app), and I'm doing it this way, and it works however I'd like to have it be a single invocation

./gradlew :appA:decryptSecretsData -Pkey=$APPA_SECRETS_KEY :appB:decryptSecretsData -Pkey=$APPB_SECRETS_KEY

and this obviously doesnt work as the second

-Pkey

overwrites the first bla bla can I somehow scope the

-Pkey

to a task?

no but if the tasks used https://docs.gradle.org/current/javadoc/org/gradle/api/tasks/options/Option.html for their input then they could be set separately in the same invocation

If you cannot change the task but the property mapping, just add the project name to the property name 🤷🏻‍♂️

-PkeyProjectA

but its the same task via convention plugin applied to both apps, how can i change the prop name? the task doesnt know where its applied to..unless im missing something

easy to apply it in the plugin that configures the task

abstract class DecryptSecretsData : DefaultTask() {
    @get:Option(option = "key", description = "decryption key")
    abstract val key: Property<String>
}

tasks.register<DecryptSecretsData>("decryptSecretsData") {
    key.convention(providers.gradleProperty("${path.trimStart(':').replace(':', '.')}.key"))
}

./gradlew :appA:decryptSecretsData --key=$APPA_SECRETS_KEY :appB:decryptSecretsData --key=$APPB_SECRETS_KEY
./gradlew -PappA.decryptSecretsData.key=$APPA_SECRETS_KEY -PappP.decryptSecretsData.key=$APPB_SECRETS_KEY :appA:decryptSecretsData :appB:decryptSecretsData

(and it's doable in the task init too, but that's not a good pattern)

btw what do you think about

--key=....

pattern for decryption key? bad idea?

as long as there's also

-keyFile=

so that the user can prevent it from being visible to other processes on the same host

can you elaborate pls? why do you mean by “also” .. sounds like you mean to use files instead of string values?

You can provide both options. But the file option is safer. If multiple users use a system they might see the argument in the process list. So if you give the secret with

--key

, they see the secret. If you give the secret with

--keyfile

, they see the file name, but you can protect the fine content from their eyes. But for ad-hoc execution on a single user system

--key

might be more convenient. So if you want to only have one, better go with

--keyfile

, or provide both.

okay so keyfile means path, i see