Try base64 encoding the nexus password also.

Author: nedtwigg

.github/workflows/deploy.yml

@@ -29,7 +29,7 @@ jobs:
     env:
       gh_token: ${{ secrets.GH_TOKEN }}
       ORG_GRADLE_PROJECT_nexus_user: ${{ secrets.NEXUS_USER }}
-      ORG_GRADLE_PROJECT_nexus_pass: ${{ secrets.NEXUS_PASS }}
+      ORG_GRADLE_PROJECT_nexus_pass64: ${{ secrets.NEXUS_PASS64 }}
       ORG_GRADLE_PROJECT_gpg_passphrase: ${{ secrets.GPG_PASSPHRASE }}
       ORG_GRADLE_PROJECT_gpg_key64: ${{ secrets.GPG_KEY64 }}
     steps:

gradle/java-publish.gradle

@@ -1,6 +1,20 @@
+import java.nio.charset.StandardCharsets
+
+def decode64(String varNam) {
+	String envValue = System.env['ORG_GRADLE_PROJECT_nexus_user']
+	if (envValue == null) {
+		return ""
+	} else {
+		return new String(envValue.decodeBase64(), "UTF-8")
+	}
+}
 
 if (project.parent == null) {
 	group = 'com.diffplug.spotless'
+	def pass = System.env['ORG_GRADLE_PROJECT_nexus_pass64']
+	if (pass != null) {
+		pass = pass.decodeBase64()
+	}
 	// it's the root project
 	apply plugin: 'io.github.gradle-nexus.publish-plugin'
 	nexusPublishing {
@@ -9,7 +23,7 @@ if (project.parent == null) {
 				nexusUrl.set(uri("https://s01.oss.sonatype.org/service/local/"))
 				snapshotRepositoryUrl.set(uri("https://s01.oss.sonatype.org/content/repositories/snapshots/"))
 				username = System.env['ORG_GRADLE_PROJECT_nexus_user']
-				password = System.env['ORG_GRADLE_PROJECT_nexus_pass']
+				password = decode64('ORG_GRADLE_PROJECT_nexus_pass64')
 			}
 		}
 	}
@@ -158,7 +172,7 @@ model {
 
 if (!version.endsWith('-SNAPSHOT')) {
 	signing {
-		String gpg_key = new String(System.env['ORG_GRADLE_PROJECT_gpg_key64'].decodeBase64())
+		String gpg_key = decode64('ORG_GRADLE_PROJECT_gpg_key64')
 		useInMemoryPgpKeys(gpg_key, System.env['ORG_GRADLE_PROJECT_gpg_passphrase'])
 		sign(publishing.publications)
 	}