This seems to be about Hosting request for plugin · Issue #2457 · jenkins-infra/repository-permissions-updater · GitHub
SecretRetriever is used in redpen-jenkins-integration/RedpenJenkinsListener.java at 585e59e2dc997be93ae12486a0fdfe0e8fcb54e9 · AjmeraInfotech/redpen-jenkins-integration · GitHub which has a Run and gets the credential ID from job properties. That could just use findCredentialById(String id, Class<C> type, Run<?,?> run, List<DomainRequirement> domainRequirements) instead of looping over the results of lookupCredentials and comparing credential IDs. See Track usage of a credential against specific Jenkins context object