secretEnv not working correctly

[petrucci89]

using this statement in cloudbuild.yaml i got $POSTGRES_PASSWORD as value of env variable POSTGRES_PASSWORD

- name: gcr.io/google-appengine/exec-wrapper
    args:
      - '-i'
      - '$_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA'
      - '-s'
      - '${PROJECT_ID}:${_DEPLOY_REGION}:${_DB_INSTANCE}'
      - '-e'
      - 'POSTGRES_HOST=${_POSTGRES_HOST}'
      - '-e'
      - 'POSTGRES_PASSWORD=$$POSTGRES_PASSWORD'
      - '--'
      - 'python'
      - 'manage.py'
      - 'migrate'
    id: Migrate
    secretEnv: ['POSTGRES_PASSWORD']

but using this statement everything work correctly

- name: gcr.io/google-appengine/exec-wrapper
    entrypoint: bash
    args: ['-c', "/buildstep/execute.sh -i $_GCR_HOSTNAME/$PROJECT_ID/$REPO_NAME/$_SERVICE_NAME:$COMMIT_SHA -s ${PROJECT_ID}:${_DEPLOY_REGION}:${_DB_INSTANCE} -e POSTGRES_HOST=${_POSTGRES_HOST} -e POSTGRES_PASSWORD=$$POSTGRES_PASSWORD -- python manage.py migrate"]
    id: Migrate
    secretEnv: ['POSTGRES_PASSWORD']