[JENKINS-46415] Either function parameters or variables from withCredentials plugin don't work correctly

I have a function in a shared library that uses the withCredentials plugin and is called from a Jenkins declarative pipeline. See the following experimental code:

def call(String name, String version) {

  withCredentials([usernamePassword(credentialsId: 'xxx', usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD')]) {

    sh '''#!/bin/bash -xe

      echo "${USERNAME}:${PASSWORD}"

      echo \"${USERNAME}:${PASSWORD}\"

      echo "${name}:${version}"

      echo \"${name}:${version}\"

    '''

    sh """#!/bin/bash -xe

      echo "${env.USERNAME}:${env.PASSWORD}"

      echo \"${env.USERNAME}:${env.PASSWORD}\"

      echo "${USERNAME}:${PASSWORD}"

      echo \"${USERNAME}:${PASSWORD}\"

      echo "${name}:${version}"

      echo \"${name}:${version}\"

    """

  }

}

I can't figure out how to get access to both, the function parameters and the variables from withCredentials in the same command. (This is just experimental code where I COULD split up the script. In the actual code I can't.) Using ''', the credentials are correct and the parameters are blank. Using """, the password, which can contain special characters, is shown in clear text (and cut), but the function parameters work fine. Is there a bug? How does this need to be done correctly?

---
Originally reported by ahuemer, imported from: Either function parameters or variables from withCredentials plugin don't work correctly

• status: Open
  
• priority: Minor
  
• component(s): pipeline
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 2025-12-08
  

Raw content of original issue

I have a function in a shared library that uses the withCredentials plugin and is called from a Jenkins declarative pipeline. See the following experimental code:




def call(String name, String version) {

  withCredentials([usernamePassword(credentialsId: 'xxx', usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD')]) {

    sh '''#!/bin/bash -xe

      echo "${USERNAME}:${PASSWORD}"

      echo \"${USERNAME}:${PASSWORD}\"

      echo "${name}:${version}"

      echo \"${name}:${version}\"

    '''

    sh """#!/bin/bash -xe

      echo "${env.USERNAME}:${env.PASSWORD}"

      echo \"${env.USERNAME}:${env.PASSWORD}\"

      echo "${USERNAME}:${PASSWORD}"

      echo \"${USERNAME}:${PASSWORD}\"

      echo "${name}:${version}"

      echo \"${name}:${version}\"

    """

  }

}





I can't figure out how to get access to both, the function parameters and the variables from withCredentials in the same command. (This is just experimental code where I COULD split up the script. In the actual code I can't.) Using ''', the credentials are correct and the parameters are blank. Using """, the password, which can contain special characters, is shown in clear text (and cut), but the function parameters work fine. Is there a bug? How does this need to be done correctly?

• environment: Jenkins 2.60.3 on Linux Mint

Start with the shared-library call, the withCredentials block, and the sh steps shown in the issue. Reproduce the triple-quoted and interpolated-string cases in a Jenkins declarative pipeline and inspect how function parameters and credential variables are expanded. Done means both values work in one command without exposing the password.

Written by the indexing model from the issue text.