What's the recommended way to deal with credentials like API keys that are required for tasks? passed as properties? env variables? read from stdlin? gradle properties in home? some other way? Asking because most of these seem like bad ideas after the recent NPM supply chain attacks and reading from stdlin feels bad when you need more than 1 token

It's quite hard to be insecure so long as you're publishing to Maven Central. Maybe the worst outcome is your key gets leaked? But it's possible to revoke it. If you're using CI then store them as secrets (GitHub Actions you can store the credentials as secrets, and GitHub will censor the logs if they do accidentally get printed to console), you can pass them in to Gradle as

ORG_GRADLE_PROJECT_...

environment variables docs. The npm ecosystem has problems that just don't exist in the JVM world (I'm happy to say more if you're interested).

for sure, but I work with NPM as well and these attacks gobble up env variables and other files

Only give the credentials to builds that actually need them. If you do not set the env variable or whatever while running npm, it cannot be read. So only set it while doing the concrete JVM build that really needs it.

to that point, I literally have this in an OSS project. I think this is the right way to do it. If it could be improved, someone please let me know

- name: Publish snapshot
  if: github.repository == 'autonomousapps/dependency-analysis-gradle-plugin' && github.ref == 'refs/heads/main'
  run: './gradlew :publishToMavenCentral'
  env:
    ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
    ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}