pipeline: build the env vars for the command line correctly

This hides passwords and secrets by looking for None in the env dict.
Currently, this has no effect but the next commit will fix this.