Is it safe to write password in signing configuration?

I have been thinking about that recently and I've figured out better solution. You can put in gradle configuration information from where it should look for signing data. So If You are working with git You can ignore that file. Any new developer after taking the project and willing to sign apk will have to obtain mentioned file before building release.

Here is the example. In gradle file in signingConfigs tag You use Properties which is reading keystore.config containing signing information:

signingConfigs {
    release {
        Properties keystoreProps = new Properties()
        keystoreProps.load(new FileInputStream(file('keystore.config')))

        keyAlias keystoreProps['keyAlias']
        keyPassword keystoreProps['keyPassword']
        storePassword keystoreProps['storePassword']
        storeFile file('keystore.jks')
    }
}

Here is the keystore.config file:

keyAlias=MyAlias
keyPassword=MyPassword
storePassword=StorePassword

The above solution assumes that the keystore.jks and keystore.config are located in the app folder but You are free to change the path.