./gradlew :app:decryptSecrets --key=...
./gradlew :app:assembleRelease

Currently I have a task which decrypts secrets, and then assemble task has a provider which reads the properties (once decrypted) and uses them to sign release build (android)

def signingProperties = providers.fileContents(layout.projectDirectory.file("signing.properties")).asText
            .map {
                def properties = new Properties()
                properties.load(new StringReader(it))
                properties
            }

android {
    signingConfigs {
        release {
            def props = signingProperties.getOrNull()
            if (props != null) {
                keyAlias props["keyAlias"]
                keyPassword props["keyPassword"]
                ...
            }
        }
    }
}

It works. Now, for more performance I was hoping to turn this into a single

gradlew

invocation =

./gradlew  :app:decryptSecrets --key=... :app:assembleRelease

but im running into this kinda obvious issue of

def props = signingProperties.getOrNull()

getting evaluated at config time, and obviously the signing properties are not decrypted yet, so they dont exist, they become available only after

decryptSecrets

finishes So is this even possible? To have the properties wired somehow in only at execution time so I can run the two in one invocation? Or, is this a bad idea

DSL isn't using lazy properties so I don't think you can do it lazy in a single invocation. Personally I just do all the download/decrypt in a bash step before invoking gradle. falls back to the debug keystore config if that bash stuff didn't get ran.

yea so effectively what i do, shame on agp 😄 thx