Use Variable Groups from KeyVault with underscore in the Android gradle file variable name

Question

I have some problem with my Azure pipelines to build an Android app. I want to build a single build pipeline (and perhaps release at same time to App Center) in Azure DevOps. I have connected the variable groups in DevOps to the KeyVault. But the KeyVault won't let me use underscore "_" and instead I have chosen hyphen "-". This becomes a problem, because the gradle file won't accept hyphens, and KeyVault won't accept underscore.

Anyway, I have tried to work around this issue by remapping the variables in the pipeline, but it does not seem that the variable groups and the task "Replace tokens" is functioning the way I have setup. My variables don't propagate and I get the unresolved variables in the artifacts...

Anybody got any advise how to solve? Any suggestion at all is thanked for..!

Here is how I set it up:

stages:
- stage: build
  jobs:
  - job: buildAppDEV
    variables:
    - group: SecretsDEV
    pool:
      name: Azure Pipelines
      demands:
      - JDK
    steps:
    - task: PowerShell@2
      displayName: 'Fix variables - to _'
      inputs:
        targetType: inline
        script: |
          echo '##vso[task.setvariable variable=CLIENT_ID;]$(CLIENT-ID)'
          echo '##vso[task.setvariable variable=CLIENT_SECRET;]$(CLIENT-SECRET)'
          echo '##vso[task.setvariable variable=GRANT_TYPE;]$(GRANT-TYPE)'
          echo '##vso[task.setvariable variable=OAUTH_CONNECTION_URL;]$(OAUTH-CONNECTION-URL)'
          echo '##vso[task.setvariable variable=CONNECTION_URL;]$(CONNECTION-URL)'
    - task: replacetokens@5
      inputs:
        rootDirectory: '/app'
        targetFiles: 'build.gradle'
        encoding: 'auto'
        tokenPattern: 'default'
        writeBOM: true
        verbosity: 'detailed'
        actionOnMissing: 'warn'
        keepToken: false
        actionOnNoFiles: 'warn'
        enableTransforms: false
        useLegacyPattern: false
        enableTelemetry: false
    - task: PowerShell@2
      displayName: 'PowerShell Script'
      enabled: false
      inputs:
        targetType: inline
        script: "$BasePath = \"$(Build.SourcesDirectory)\\\"\n$BuildGradlePath = \"${BasePath}\\app\\build.gradle\"\n$BuildGradleUpdatedPath = \"${BasePath}\\app\\build.gradle.updated\"\nGet-Content $BuildGradlePath | ForEach-Object {\n    if($_ -match \"versionCode \\d\"){\n        $versionCode = $_ -replace \"versionCode\", \"\" -as [int]\n        $newVersionCode = $versionCode + 1\n        \n        Write-Host \"Found versionCode ${versionCode}. Updated to ${newVersionCode}\"\n        \n        $_ = \"        versionCode \" + $newVersionCode   \n    }\n    $_\n} | Set-Content $BuildGradleUpdatedPath;\nGet-Content $BuildGradleUpdatedPath | Set-Content $BuildGradlePath\n"
    - task: PowerShell@2
      displayName: 'Print out versioncode and versionname'
      inputs:
        targetType: inline
        script: |
          Write-Host "Version print job start"
          Write-Host "VersionName $(Build.BuildNumber)"
          Write-Host "Version print job end"
          Write-Host "Gradle testing"
          Write-Host "Test secret $(keystore-password)"
          Write-Host "Test secret $(OAUTH_CONNECTION_URL)"
          Write-Host "Test secret $(OAUTH-CONNECTION-URL)"
          Write-Host "Gradle testing"
    - task: Gradle@3
      inputs:
        gradleWrapperFile: 'gradlew'
        workingDirectory: 'app'
        tasks: bundle
        publishJUnitResults: false
        testResultsFiles: '**/TEST-*.xml'
        javaHomeOption: 'JDKVersion'
        sonarQubeRunAnalysis: false
        spotBugsAnalysis: false
    - task: AndroidSigning@2
      inputs:
        apkFiles: '**/*.aab'
        jarsign: true
        jarsignerKeystoreFile: 'x'
        jarsignerKeystorePassword: '$(keystore-password)'
        jarsignerKeystoreAlias: '$(keystore-alias)'
        jarsignerKeyPassword: '$(key-password)'
        jarsignerArguments: '-sigalg SHA256withRSA -digestalg SHA-256'
        zipalign: true
    - task: CopyFiles@2
      displayName: 'Copy Files to: $(build.artifactstagingdirectory)'
      inputs:
        SourceFolder: '$(system.defaultworkingdirectory)/app/build/outputs/bundle/release/'
        Contents: '**/*.aab'
        TargetFolder: '$(build.artifactstagingdirectory)'
    - task: PublishBuildArtifacts@1
      displayName: 'Publish Artifact: drop'
    - task: AppCenterDistribute@3
      inputs:
        serverEndpoint: 'sc'
        appSlug: 'app/app'
        appFile: '$(build.artifactstagingdirectory)/**/*.aab'
        releaseNotesOption: 'input'
        releaseNotesInput: 'test new pipeline'
        destinationType: 'store'
        destinationStoreId: 'x'
  - job: buildAppQA
    dependsOn:
    - buildAppDEV
    variables:
    - group: SecretsQA
    pool:
      name: Azure Pipelines
      demands:
      - JDK
    steps:
    - task: PowerShell@2
      displayName: 'Fix variables - to _'
      inputs:
        targetType: inline
        script: |
          echo '##vso[task.setvariable variable=CLIENT_ID;]$(CLIENT-ID)'
          echo '##vso[task.setvariable variable=CLIENT_SECRET;]$(CLIENT-SECRET)'
          echo '##vso[task.setvariable variable=GRANT_TYPE;]$(GRANT-TYPE)'
          echo '##vso[task.setvariable variable=OAUTH_CONNECTION_URL;]$(OAUTH-CONNECTION-URL)'
          echo '##vso[task.setvariable variable=CONNECTION_URL;]$(CONNECTION-URL)'
    - task: replacetokens@5
      inputs:
        rootDirectory: '/app'
        targetFiles: 'build.gradle'
        encoding: 'auto'
        tokenPattern: 'default'
        writeBOM: true
        actionOnMissing: 'warn'
        keepToken: false
        actionOnNoFiles: 'continue'
        enableTransforms: false
        useLegacyPattern: false
        enableTelemetry: false
    - task: DownloadSecureFile@1
      name: keystoreFile
      displayName: 'Download secure file'
      inputs:
        secureFile: 'x'
    - task: PowerShell@2
      displayName: 'Print out versioncode and versionname '
      inputs:
        targetType: inline
        script: |
          Write-Host "Version print job start"
          Write-Host "VersionName $(Build.BuildNumber)"
          Write-Host "Version print job end"
          Write-Host "Gradle testing"
          Write-Host "Test secret $(keystore-password)"
          Write-Host "Gradle testing"
    - task: Gradle@3
      inputs:
        gradleWrapperFile: 'gradlew'
        workingDirectory: 'app'
        tasks: bundle
        publishJUnitResults: false
        testResultsFiles: '**/TEST-*.xml'
        javaHomeOption: 'JDKVersion'
        sonarQubeRunAnalysis: false
        spotBugsAnalysis: false
    - task: AndroidSigning@2
      inputs:
        apkFiles: '**/*.aab'
        jarsign: true
        jarsignerKeystoreFile: 'x'
        jarsignerKeystorePassword: '$(keystore-password)'
        jarsignerKeystoreAlias: '$(keystore-alias)'
        jarsignerKeyPassword: '$(key-password)'
        jarsignerArguments: '-sigalg SHA256withRSA -digestalg SHA-256'
        zipalign: true
    - task: CopyFiles@2
      displayName: 'Copy Files to: $(build.artifactstagingdirectory)'
      inputs:
        SourceFolder: '$(system.defaultworkingdirectory)/app/build/outputs/bundle/release/'
        Contents: '**/*.aab'
        TargetFolder: '$(build.artifactstagingdirectory)'
    - task: PublishBuildArtifacts@1
      displayName: 'Publish Artifact: drop'
    - task: AppCenterDistribute@3
      inputs:
        serverEndpoint: 'sc'
        appSlug: 'app/app'
        appFile: '$(build.artifactstagingdirectory)/**/*.aab'
        releaseNotesOption: 'input'
        releaseNotesInput: 'test new pipeline beta'
        destinationType: 'store'
        destinationStoreId: 'x'