Closing as a duplicate of JENKINS-28335. Refer to the Google Summer of Code project idea proposing how JENKINS-28335 should be implemented.

The project idea needs additional mentors and welcomes additional insights on corner cases that might not be covered by the proposed implementation.

markewaite while this is clearly related to JENKINS-28335, the current GSoC proposal would not offer a UX comparable to what was requested in this issue’s initial description.

Thanks for the insight jglick. You're correct. I didn't read carefully enough. This issue proposes to use the credentials from the scm global variable while the GSoC proposal would require that the Pipeline must provide the credentials ID to be used in the Pipeline step. I've reopened this issue .

This gets most of the way there, albeit with more verbosity:

                withCredentials([gitUsernamePassword(credentialsId: scm.getUserRemoteConfigs()[0].getCredentialsId())]) {
                    sh '''
                    git fetch
                    '''
                } 

Thanks for the hint. This actually seems a bit safer than sticking a credential name into public Jenkisfiles (which someone else might try to abuse from their PR, etc.) Sure there are protections for PRs (who may change Jenkinsfile so its PRed code runs), folder-level credentials, etc. - but it is extra hassle and feels like an extra option for a security mistake.