Stale profile README docs three non-functional tfvars (skip_docker_build/push, enable_frontend_build) #58

Problem

terraform/profiles/README.md documents three variables in the sample profile tfvars that are not declared as root-module variables in any environment, so setting them in a .tfvars file is silently ignored by terraform (terraform only warns on undeclared variables in tfvars; it does not fail). This was surfaced while reviewing PR LeanerCloud/cloud-commitments-cli#1244, which removes the Makefile targets that previously pretended to plumb these.

Stale lines:

• terraform/profiles/README.md:116 — enable_frontend_build = true
• terraform/profiles/README.md:125 — # skip_docker_build = false
• terraform/profiles/README.md:126 — # skip_docker_push = false

Verification (on fix/hyg-04-fix, identical on main):

$ grep -rnE 'variable\s+"(skip_docker_build|skip_docker_push|enable_frontend_build)"' terraform/environments/
# (no matches)

These names exist only at module level (terraform/modules/build/variables.tf, terraform/modules/frontend/variables.tf) and are wired to hardcoded literals in each environment's build.tf (e.g. skip_docker_build = false). Profile tfvars cannot influence them.

Why this matters

A user following the README pastes the documented snippet into terraform/profiles/aws/myprofile.tfvars, gets at most a "Value for undeclared variable" warning, and assumes their override took effect. They believe they have disabled the Docker build but the build still runs. This is exactly the "fails silent, behaves as if it worked" pattern called out in feedback_no_silent_fallbacks.md.

Fix options

Either (preferred): plumb the three values up as root-module variables and pass them into the build / frontend modules in terraform/environments/{aws,azure,gcp}/build.tf (and frontend.tf). This restores the documented behaviour and reopens the door to the make docker-skip / make frontend-skip style controls PR LeanerCloud/cloud-commitments-cli#1244 deleted.

Or: delete the misleading snippets from terraform/profiles/README.md and any other docs (terraform/modules/frontend/README.md shows similar enable_frontend_build examples) so users don't reach for a knob that doesn't exist.

References

• PR fix(deploy): forward extra terraform args, drop vestigial targets cloud-commitments-cli#1244 (fix(deploy): forward extra terraform args, drop vestigial targets) — removed the only consumer of these "vars" and verified they were never declared at root
• Issue HYG-04: Makefile.terraform docker-build/docker-skip/frontend-skip silently drop their -var flag and run a plain full terraform apply cloud-commitments-cli#1172 (HYG-04, parent finding)

Findings from the 2026-09-02 codebase audit

Added by an automated audit of 3c0f8ac94048a2c36fce5ccddee54e6c4849a5cd (tip of origin/main). Each item below was reported by one reviewer and independently confirmed by a second that did not write it. Full report: docs/audits/codebase-audit-2026-09-02.md.

A13c-016 (low)

Another wrong value in the same profile examples. All three files publish database_engine_version = "16.6" (profiles/aws/dev.tfvars.example:33, fargate-dev:32, prod:33), while modules/database/aws/variables.tf:57-61 documents that pinning a full minor "causes downgrade failures if RDS auto-upgrades beyond it (incident: 2026-07-16, LeanerCloud/cloud-commitments-cli#1372)" and defaults to the major-only "16". So anyone starting from a profile inherits the exact configuration that incident was about. Every file under environments/aws/ already uses "16" (dev.tfvars.example:50, github-dev:49, github-prod:47, github-staging:46), which shows the fix landed in one place and not the other. Finding A13c-016.