Make sure that we only call secret_variables_for once

app/models/ci/build.rb

@@ -393,13 +393,13 @@ module Ci
     end
 
     def secret_variables(with_environment: true)
-      variables = project.secret_variables_for(ref: ref)
-
-      if with_environment
-        variables.concat(
+      variables =
+        if with_environment
           project.secret_variables_for(
-            ref: ref, environment: persisted_environment))
-      end
+            ref: ref, environment: persisted_environment)
+        else
+          project.secret_variables_for(ref: ref)
+        end
 
       variables.map(&:to_runner_variable)
     end

spec/models/ci/build_spec.rb

@@ -1388,6 +1388,24 @@ describe Ci::Build, :models do
       context 'when the ref is not protected' do
         it { is_expected.not_to include(protected_variable) }
       end
+
+      # EE
+      context 'when environment specific variable is defined' do
+        let(:environment_varialbe) do
+          { key: 'ENV_KEY', value: 'environment', public: false }
+        end
+
+        before do
+          build.update(environment: 'staging')
+          create(:environment, name: 'staging', project: build.project)
+
+          create(:ci_variable,
+                 environment_varialbe.slice(:key, :value)
+                   .merge(project: project, scope: 'stag*'))
+        end
+
+        it { is_expected.to include(environment_varialbe) }
+      end
     end
 
     context 'when build is for triggers' do
@@ -1520,13 +1538,10 @@ describe Ci::Build, :models do
         allow(pipeline).to receive(:predefined_variables) { [pipeline_pre_var] }
         allow(build).to receive(:yaml_variables) { [build_yaml_var] }
 
-        allow(project).to receive(:secret_variables_for).with(ref: 'master') do
-          [create(:ci_variable, key: 'secret', value: 'value')]
-        end
-
         allow(project).to receive(:secret_variables_for)
           .with(ref: 'master', environment: nil) do
-            [create(:ci_variable, key: 'env', value: 'value')]
+            [create(:ci_variable, key: 'secret', value: 'value'),
+             create(:ci_variable, key: 'env', value: 'value')]
           end
       end