Version 887 breaks usage of scm.userRemoteConfigs[].credentialsId

[TwoStone]

Jenkins and plugins versions report

Environment

Jenkins: 2.452.2
OS: Linux - 6.5.0-1020-aws
Java: 17.0.11 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)

What Operating System are you using (both controller, and any agents involved in the problem)?

Linux - 6.5.0-1020-aws on kubernetes

Reproduction steps

We have some steps in our jenkins pipelines that use the credentials provided for the checkout for other git actions. Therefor we use some credentials binding withCredentials([usernamePassword( credentialsId: scm.userRemoteConfigs[0].credentialsId, usernameVariable: 'GIT_USERNAME', passwordVariable: 'GIT_PASSWORD' )])

This works with versions of these plugin previous to 887

Expected Results

scm.userRemoteConfigs[0].credentialsId returns the credentials id

Actual Results

Jenkins build breaks with:

09:34:41 java.lang.NullPointerException 09:34:41 at java.base/java.util.Objects.requireNonNull(Unknown Source) 09:34:41 at com.cloudbees.plugins.credentials.CredentialsProvider.findCredentialById(CredentialsProvider.java:897) 09:34:41 at com.cloudbees.plugins.credentials.CredentialsProvider.findCredentialById(CredentialsProvider.java:866) 09:34:41 at org.jenkinsci.plugins.credentialsbinding.MultiBinding.getCredentials(MultiBinding.java:195) 09:34:41 at org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding.bind(UsernamePasswordMultiBinding.java:73) 09:34:41 at org.jenkinsci.plugins.credentialsbinding.impl.BindingStep$Execution2.doStart(BindingStep.java:132) 09:34:41 at org.jenkinsci.plugins.workflow.steps.GeneralNonBlockingStepExecution.lambda$run$0(GeneralNonBlockingStepExecution.java:77) 09:34:41 at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) 09:34:41 at java.base/java.util.concurrent.FutureTask.run(Unknown Source) 09:34:41 at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) 09:34:41 at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) 09:34:41 at java.base/java.lang.Thread.run(Unknown Source)

Anything else?

I think this was very likely introduced by the security fix https://github.com/jenkinsci/bitbucket-branch-source-plugin/commit/ad359b3d2d8d6c114025d81abc59b3c9acb636df

Is this a bug or is it the intended behaviour?

Are you interested in contributing a fix?

No response