Continuous integration

HashGuard has no interface and reads everything from files and the environment, so it runs in any CI system. The only CI-specific part is the licence.

Provide the licence

• Store your licence key as a secret variable of your CI system, named PLR_LICENCE_KEY.
• Never use -licence-login in CI: runners have no desktop keyring, and the CLI reads PLR_LICENCE_KEY first anyway.
• Each runner machine takes one seat of your licence while the job runs. The seat is released when the CLI exits. Plan your seats for the number of runners that obfuscate at the same time.

See Licence for how seats are counted.

Keep the mapping private

If you export a mapping, it reverses the renaming. Keep it as a private, short-lived artifact of the job, or upload it to your error tracker, and never ship it with the jar.

GitLab CI

obfuscate:
  stage: build
  image: eclipse-temurin:25-jdk
  script:
    - ./gradlew jar
    - hashguard -config obfuscator-config.json
  artifacts:
    paths:
      - build/libs/app-protected.jar

PLR_LICENCE_KEY is defined in the project’s CI/CD variables, masked and protected, and reaches the job as an environment variable.

GitHub Actions

jobs:
  obfuscate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '25'
      - run: ./gradlew jar
      - run: hashguard -config obfuscator-config.json
        env:
          PLR_LICENCE_KEY: ${{ secrets.PLR_LICENCE_KEY }}

Both examples assume the CLI is on the runner’s PATH; with the Gradle plugin, replace the last step with ./gradlew plrObfuscate.