Snippet of a build.gradle that uses Gradle properties for key store passwords. I usually do not check in gradle.properties and on the CI machine the properties are provided using the -P switch.

build.gradle

apply plugin: 'android'

// use the standard Gradle version property, handy if you use plugins that also rely on this
version = "1.0"

ext {
    // These properties are set in gradle.properties (not checked in to vcs) or using -P on the command line.
    // If they are not set, provide a default otherwise the build won't run.
    // Obviously, with the default password a release build will fail
    keyStorePassword = ext.has("keyStorePassword") ? ext.keyStorePassword : "not-set"
    keyAliasPassword = ext.has("keyAliasPassword") ? ext.keyAliasPassword : "not-set"
    // apk's will be named myapp-v1.0-debug.apk etc
    archivesBaseName = "myapp-v${version}"
}

android {
    compileSdkVersion 19
    buildToolsVersion "19.0.3"

    defaultConfig {
        minSdkVersion 9
        targetSdkVersion 19
        // you could also calculate versionCode if you like from version components.
        versionCode 1
        // the version we defined
        versionName version
    }

    signingConfigs {
        release {
            // where the keystore is located, checked in vcs or provided through other means
            storeFile file("certs/mykeystore.jks")
            storePassword keyStorePassword
            keyAlias "myappkey"
            keyPassword keyAliasPassword
        }
    }
}