Does not seem to be specific to password parameters, just a problem in parameter expansion generally.
workflow-job #151 includes a minimal self-contained test case.