Run-scoped, in-memory Jenkins CredentialsProvider: resolves credentials only for the Pipeline build currently executing, and only what that build itself cached. Nothing it holds is ever written to disk. Accompanied by a withEphemeralCredentials step to dynamically input() missing credentials in a pipeline/JSL, extensible for caller-defined classes. - View it on GitHub