Document intersection of "secret" env vars + partial parsing

[jtcohen6]

Contributions

• I have read the contribution docs, and understand what's expected of me.

Link to the page on docs.getdbt.com requiring updates

• https://docs.getdbt.com/reference/parsing#known-limitations
• https://docs.getdbt.com/reference/dbt-jinja-functions/env_var#secrets

What part(s) of the page would you like to see updated?

Env vars prefixed DBT_ENV_SECRET_ can be used in profiles.yml + packages.yml. Their values will be scrubbed from logs.

We should make clear that changes to secrets used in profiles.yml do not trigger full re-parses (unlike changes to other env vars used in the active profile), because dbt will not be storing their values (once dbt-labs/dbt-core#4650 is fixed). This can be a limitation or a feature, depending on your point of view.

Additional information

See dbt-labs/dbt-core#4642 (comment)

[jtcohen6]

In discussing the fix proposed in dbt-labs/dbt-core#9795 with @gshank, we are thinking that while this is an outcome of the current implementation of (secret) env vars + partial parsing, it's not actually the desirable behavior longer-term. The right way to avoid full parses when inputs haven't changed is to more granularly track where those inputs are being used — that is, extending what we've done for env vars to --vars and {{ target }} values.