If you take a look at the build output you will see this:
Suppressing export of environment variables DOCKEREMAIL, DOCKERLOGIN, DOCKERPASS, BRAKEMAN_PRO_URL, GEMNASIUM_TESTSUITE, GEMNASIUM_PROJECT_SLUG, GEMNASIUM_TOKEN fork PR builds
On Fork PR builds we do not export ENVARS since this would mean that anyone who opens a fork will be able to see your secrets (i.e. by adding echo $ENVAR to circle.yml)
You can enable ENVARS for forks in project settings, but we do not recommend doing this.