refactor: read image_version from a single VERSION file, no per-template copies

.github/workflows/drupal-contrib-integration-test.yml

@@ -92,16 +92,14 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION drupal-contrib/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push drupal-contrib \
             --directory drupal-contrib \
             --activate=false \
             --name ${{ env.WORKSPACE_NAME }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev
 
       - name: Create workspace
@@ -274,16 +272,14 @@ jobs:
           echo "ISSUE_BRANCH=$ISSUE_BRANCH"         >> "$GITHUB_ENV"
           echo "ISSUE_FORK_VERSION=$DRUPAL_VERSION" >> "$GITHUB_ENV"
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION drupal-contrib/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push drupal-contrib \
             --directory drupal-contrib \
             --activate=false \
             --name cc-${{ github.run_number }}-${{ github.run_attempt }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev
 
       - name: Create workspace
@@ -424,16 +420,14 @@ jobs:
           access_url: ${{ vars.TEST_CODER_URL }}
           coder_session_token: ${{ env.TEST_CODER_SESSION_TOKEN }}
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION drupal-contrib/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push drupal-contrib \
             --directory drupal-contrib \
             --activate=false \
             --name ${{ env.WORKSPACE_NAME }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             --variable github_token=${{ secrets.GITHUB_TOKEN }}
 
@@ -579,16 +573,14 @@ jobs:
           echo "ISSUE_BRANCH=$ISSUE_BRANCH"         >> "$GITHUB_ENV"
           echo "ISSUE_FORK_VERSION=$DRUPAL_VERSION" >> "$GITHUB_ENV"
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION drupal-contrib/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push drupal-contrib \
             --directory drupal-contrib \
             --activate=false \
             --name gc-${{ github.run_number }}-${{ github.run_attempt }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             --variable github_token=${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/drupal-integration-test.yml

@@ -91,16 +91,14 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION drupal-core/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push drupal-core \
             --directory drupal-core \
             --activate=false \
             --name ${{ env.WORKSPACE_NAME }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             --variable cache_path=/home/rfay/cache/drupal-core-seed \
             --variable github_token=${{ secrets.GITHUB_TOKEN }}
@@ -231,16 +229,14 @@ jobs:
           access_url: ${{ vars.TEST_CODER_URL }}
           coder_session_token: ${{ env.TEST_CODER_SESSION_TOKEN }}
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION drupal-core/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push drupal-core \
             --directory drupal-core \
             --activate=false \
             --name ${{ env.WORKSPACE_NAME }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             --variable cache_path=/home/rfay/cache/drupal-core-seed \
             --variable github_token=${{ secrets.GITHUB_TOKEN }}
@@ -337,16 +333,14 @@ jobs:
           echo "ISSUE_BRANCH=$ISSUE_BRANCH"   >> "$GITHUB_ENV"
           echo "ISSUE_FORK_VERSION=$DRUPAL_VERSION" >> "$GITHUB_ENV"
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION drupal-core/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push drupal-core \
             --directory drupal-core \
             --activate=false \
             --name cd-${{ github.run_number }}-${{ github.run_attempt }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             --variable cache_path=/home/rfay/cache/drupal-core-seed \
             --variable github_token=${{ secrets.GITHUB_TOKEN }}
@@ -486,16 +480,14 @@ jobs:
           echo "ISSUE_BRANCH=$ISSUE_BRANCH"        >> "$GITHUB_ENV"
           echo "ISSUE_FORK_VERSION=$DRUPAL_VERSION" >> "$GITHUB_ENV"
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION drupal-core/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push drupal-core \
             --directory drupal-core \
             --activate=false \
             --name gd-${{ github.run_number }}-${{ github.run_attempt }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             --variable cache_path=/home/rfay/cache/drupal-core-seed \
             --variable github_token=${{ secrets.GITHUB_TOKEN }}

.github/workflows/integration-test.yml

@@ -114,16 +114,14 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION ${{ matrix.template }}/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push ${{ matrix.template }} \
             --directory ${{ matrix.template }} \
             --activate=false \
             --name ci-${{ env.CI_TAG }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             ${{ matrix.extra_vars }}
 
@@ -329,16 +327,14 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION ${{ matrix.template }}/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push ${{ matrix.template }} \
             --directory ${{ matrix.template }} \
             --activate=false \
             --name ci-gh-${{ env.CI_TAG }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             ${{ matrix.extra_vars }}
 

.github/workflows/staging-push.yml

@@ -67,16 +67,14 @@ jobs:
           access_url: ${{ vars.TEST_CODER_URL }}
           coder_session_token: ${{ env.TEST_CODER_SESSION_TOKEN }}
 
-      - name: Copy VERSION into template directory
-        run: cp VERSION ${{ matrix.template }}/VERSION
-
       - name: Push template (inactive)
         run: |
           coder templates push ${{ matrix.template }} \
             --directory ${{ matrix.template }} \
             --activate=false \
             --name ${{ env.VERSION_NAME }} \
             --yes \
+            --variable image_version="$(cat VERSION)" \
             --variable workspace_image_registry=index.docker.io/ddev/coder-ddev \
             ${{ matrix.extra_vars }}
 

CLAUDE.md

@@ -238,7 +238,7 @@ The startup script is inline in each template's `template.tf` (e.g. `freeform/te
 ### Terraform Variables
 Key template variables (e.g. in `freeform/template.tf`):
 - `workspace_image_registry` - Docker registry URL (default: `index.docker.io/ddev/coder-ddev`)
-- `image_version` - Image tag (default: read from `VERSION` file or `v0.1`)
+- `image_version` - Image tag (default: `v0.1`; the Makefile passes `--variable image_version=$(cat VERSION)` at push time, so the root `VERSION` file is the single source of truth — no per-template copies)
 - `cpu` / `memory` - Resource limits (defaults: 4 cores, 8GB RAM)
 - `node_version` - Node.js version (default: `24`, informational only — Node is pre-installed in image)
 - `docker_gid` - Docker group GID (default: `988`)
@@ -352,6 +352,6 @@ Additional logs in workspace:
 - `scripts/coder-delete-workspace-dir.sh` - Sudo wrapper for workspace host dir cleanup (must be installed on server)
 - `scripts/cleanup-deleted-workspaces.sh` - Manual cleanup for orphaned workspace dirs/volumes
 - `scripts/workspace-lifecycle-cleanup.sh` - Notifies then deletes idle workspaces; runs via systemd timer on coder.ddev.com (production only, see `scripts/workspace-lifecycle-cleanup.service`/`.timer`, must be installed on server)
-- `VERSION` - Image version used by all templates (read automatically by Makefile)
+- `VERSION` - Single source of truth for the image version; read by the Makefile and passed to every template as `--variable image_version=...` at push time (no per-template copies)
 - `openspec/project.md` - Project conventions and constraints
 - `openspec/AGENTS.md` - OpenSpec workflow instructions

Makefile

@@ -44,10 +44,8 @@ TEMPLATE_EDIT_freeform         := --display-name "DDEV Freeform" \
 
 # Shared recipe for pushing any template (call with template name as argument)
 define push_template
-	@echo "Syncing VERSION to $(1)..."
-	cp VERSION $(1)/VERSION
-	@echo "Pushing Coder template $(1)..."
-	coder templates push --directory $(1) $(1) --yes --activate=$(ACTIVATE) $(TEMPLATE_VARS_$(1))
+	@echo "Pushing Coder template $(1) (image_version=$(VERSION))..."
+	coder templates push --directory $(1) $(1) --yes --activate=$(ACTIVATE) --variable image_version=$(VERSION) $(TEMPLATE_VARS_$(1))
 	@echo "Setting template metadata for $(1)..."
 	coder templates edit $(1) --yes $(TEMPLATE_EDIT_$(1))
 	@echo "Template $(1) push complete"

drupal-contrib/.gitignore

@@ -0,0 +1,5 @@
+# Vault token file (not committed to Git)
+vault-token.txt
+
+# Terraform working directory
+.terraform/

drupal-contrib/template.tf

@@ -219,7 +219,7 @@ locals {
 }
 
 locals {
-  image_version                 = try(trimspace(file("${path.module}/VERSION")), var.image_version)
+  image_version                 = var.image_version
   registry_without_version      = replace(var.workspace_image_registry, ":${local.image_version}", "")
   workspace_image_registry_base = replace(local.registry_without_version, ":latest", "")
 }

drupal-core/.gitignore

@@ -1,8 +1,5 @@
 # Vault token file (not committed to Git)
 vault-token.txt
 
-# VERSION is copied from root by Makefile before push
-VERSION
-
 # Terraform working directory
 .terraform/

drupal-core/template.tf

@@ -212,8 +212,8 @@ locals {
 }
 
 locals {
-  # Read image version from VERSION file if it exists, otherwise use variable default
-  image_version = try(trimspace(file("${path.module}/VERSION")), var.image_version)
+  # Set via --variable image_version=$(cat VERSION) by the Makefile at push time.
+  image_version = var.image_version
 
   # Remove any tag (including :latest) if present, but preserve port numbers (e.g., :5050)
   # Remove common tags from the end of the registry URL
@@ -252,7 +252,7 @@ variable "vscode_extensions" {
 variable "workspace_image_registry" {
   description = "Docker registry URL for the workspace base image (without tag, version is added automatically)"
   type        = string
-  # The version tag is appended automatically using the image_version variable or VERSION file
+  # The version tag is appended automatically using the image_version variable.
   # DO NOT include :latest or any version tag here - version comes from image_version variable
   # To use a specific version, override the image_version variable when deploying
   default = "index.docker.io/ddev/coder-ddev"
@@ -262,7 +262,7 @@ variable "workspace_image_registry" {
 # The image is built and pushed using the Makefile (see root Makefile and VERSION file)
 # This avoids prevent_destroy issues since the image is not managed by Terraform
 resource "docker_image" "workspace_image" {
-  # Always use version tag (never :latest) from the image_version variable or VERSION file
+  # Always use version tag (never :latest) from the image_version variable.
   # This ensures consistent image versions and prevents using stale images
   name = "${local.workspace_image_registry_base}:${local.image_version}"
 

freeform/.gitignore

@@ -1,8 +1,5 @@
 # Vault token file (not committed to Git)
 vault-token.txt
 
-# VERSION is copied from root by Makefile before push
-VERSION
-
 # Terraform working directory
 .terraform/

freeform/template.tf

@@ -98,7 +98,7 @@ data "coder_parameter" "vscode_extensions" {
 locals {
   workspace_home      = "/home/coder"
   selected_extensions = jsondecode(data.coder_parameter.vscode_extensions.value)
-  image_version       = try(trimspace(file("${path.module}/VERSION")), var.image_version)
+  image_version       = var.image_version
 
   registry_without_version      = replace(var.workspace_image_registry, ":${local.image_version}", "")
   workspace_image_registry_base = replace(local.registry_without_version, ":latest", "")