Should gradle.properties be in gitignore for a react native project to hide release password?

Question

I'm working on a react native app on windows. To be able to generate a signed release apk I've added MYAPP_RELEASE_STORE_PASSWORD=*** and MYAPP_RELEASE_KEY_PASSWORD=*** to my /projectname/android/gradle.properties file (Like it says so here). Now I wonder if I should add the file to gitignore to prevent it from being uploaded to github, or is there a way to store the password in a different file?

Answer 1

I found the solution for storing the passwords in a separate file here: Sign APK without putting keystore info in build.gradle

In build.gradle add:

// Load keystore
def keystorePropertiesFile = rootProject.file("keystores/release.keystore.properties");
def keystoreProperties = new Properties()
keystoreProperties.load(new FileInputStream(keystorePropertiesFile))

And a bit further down:

signingConfigs { 
    release { 
        storeFile file(keystoreProperties['MYAPP_RELEASE_STORE_FILE'])
        storePassword keystoreProperties['MYAPP_RELEASE_STORE_PASSWORD']
        keyAlias keystoreProperties['MYAPP_RELEASE_KEY_ALIAS']
        keyPassword keystoreProperties['MYAPP_RELEASE_KEY_PASSWORD']
    }
}

And then add release.keystore.properties to the .gitignore file defined like so:

MYAPP_RELEASE_STORE_FILE=x
MYAPP_RELEASE_STORE_PASSWORD=y
MYAPP_RELEASE_KEY_ALIAS=z
MYAPP_RELEASE_KEY_PASSWORD=t

(Sorry for answering my own question, I hate doing that..)