If a Cloud Manager build requires dependencies from a private, password-protected corporate artifact repository, the DevOps engineer must provide Cloud Manager with a custom Maven settings file to handle the authentication. This is done by placing a file at .cloudmanager/maven/settings.xml in the root of the AEM Git repository. Because hardcoding Basic Authentication credentials in Git is a massive security risk, the credentials inside the settings.xml should reference environment variables. The DevOps engineer then uses the Adobe I/O CLI (aio cloudmanager:set-pipeline-variables) to inject the actual username and password as secure pipeline secrets.