# HCP Terraform: wire workspaces with run triggers and variable sets
## Why
A network workspace and an app workspace that share values get out of sync the moment someone updates one by hand. Run triggers let a successful run in one workspace automatically queue runs in others. Variable sets let you define variables once and attach them to many workspaces.
## How
Run triggers: in the downstream workspace settings, add the upstream workspace as a trigger source. When the upstream run applies successfully, the downstream queues a run automatically. Use this for network -> data -> app layering.
Variable sets: define a set (for example, shared tags, region, or a common API endpoint), then attach it to every workspace that needs it. Priority matters: workspace-level variables override variable-set values, and more specific sets win over broader ones.
## Rules for agents
1. Never copy a variable into N workspaces by hand when a variable set fits. Hand copies drift.
2. Sensitive values belong in variable sets marked sensitive, or workspace variables marked sensitive. They are write-only in the UI and redacted in logs.
3. Run triggers fire on successful applies, including speculative ones configured to trigger. Check whether you want plan-only downstream runs or full applies before wiring.
4. If you need an SSH key for git-based module sources, that lives in workspace settings too, not in the config.
5. When debugging "my downstream workspace did not run", check the trigger config first, then whether the upstream run actually applied (failed or plan-only upstream runs do not trigger).