Reviewers want per-environment, non-secret values such as instance sizes and replica counts to appear in pull request diffs and in Git history next to the code. Each environment has its own directory and HCP Terraform workspace. Where should these values live?

Terraform loads files ending in .auto.tfvars automatically, and HCP Terraform does the same for files in the workspace's configuration directory. Committing one such file in each environment directory keeps non-secret values like instance sizes and replica counts in version control, so changes appear in pull request diffs, are reviewed with the code that uses them, and remain in Git history. Workspace-specific variables are correct per environment but are edited in the HCP Terraform UI or API, so changes never appear in a pull request. Variable sets have the same limitation and are designed for values shared across many workspaces, such as credentials, rather than per-environment sizing reviewed alongside code. Values typed as -var flags at run time are invisible to reviewers and impossible to reproduce from history. Exam caveat: HCP Terraform workspace variables and variable sets take precedence over .auto.tfvars files, so a leftover workspace variable with the same key silently overrides the reviewed file; keep secrets out of these files and in sensitive workspace variables or variable sets instead. Operational check: remove any duplicate workspace variables, change a value in the file through a pull request, and confirm the speculative plan reflects it.