centralize version variables into .versions

[alimx07]

Fixes #742

• Add a .versions file as the single source of truth for version variables (Go, vLLM, vLLM upstream, SGLang, llama-server, vllm-metal, diffusers, base image), replacing values scattered across the Makefile, Dockerfile and CI workflows.

• Add make validate-versions target to catch drift between .versions and Dockerfile ARG defaults, also runs as part of make validate-all

[sourcery-ai]

Hey - I've left some high level feedback:

• The repeated Load GO version steps across multiple workflows (and even twice in ci.yml) could be deduplicated by using a small reusable script or composite action, which would reduce copy‑paste and keep the GO version loading logic in one place.
• The validate-versions target assumes .versions lines map directly to ARG <KEY>=<value> with no quotes or inline comments; consider either documenting/enforcing this format or normalizing values (e.g., stripping quotes/comments) so the comparison is robust to small formatting differences.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The repeated `Load GO version` steps across multiple workflows (and even twice in `ci.yml`) could be deduplicated by using a small reusable script or composite action, which would reduce copy‑paste and keep the GO version loading logic in one place.
- The `validate-versions` target assumes `.versions` lines map directly to `ARG <KEY>=<value>` with no quotes or inline comments; consider either documenting/enforcing this format or normalizing values (e.g., stripping quotes/comments) so the comparison is robust to small formatting differences.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

Review: Centralized Version Management ### Summary This PR centralizes versioning by introducing a .versions source of truth, integrated via the Makefile and validated against the Dockerfile. ### Critical - Makefile:112: The read loop in validate-versions will skip the last line of .versions because it lacks a trailing newline; add || [ -n "$$key" ] to the loop condition. - scripts/build-vllm-metal-tarball.sh:23: Fetching VLLM_VERSION instead of VLLM_UPSTREAM_VERSION causes an unintended downgrade from 0.17.1 to 0.17.0. ### What looks good - Centralizing version variables into a single .versions file improves maintainability and reduces the risk of version drift across components.

[gemini-code-assist]

The read command returns a non-zero exit code when it encounters EOF before a newline character. Since the .versions file does not end with a newline (as indicated in the diff), the last line (currently BASE_IMAGE) will be skipped by this loop, leaving it unvalidated. Adding || [ -n "$key" ] ensures the last line is processed even if the newline is missing.

	while IFS='=' read -r key value || [ -n "$$key" ]; do \

[gemini-code-assist]

This script previously used version 0.17.1. By switching to the VLLM_VERSION key from .versions, it has been downgraded to 0.17.0. Based on the .versions file content and the vllm-metal-dev target in the Makefile, this should likely use VLLM_UPSTREAM_VERSION (which is 0.17.1) to maintain consistency and avoid an unintended version downgrade.

Suggested change

	VLLM_VERSION=$(grep '^VLLM_VERSION=' "$(cd "$(dirname "$0")/.." && pwd)/.versions" | cut -d= -f2)
	VLLM_VERSION=$(grep '^VLLM_UPSTREAM_VERSION=' "$(cd "$(dirname "$0")/.." && pwd)/.versions" | cut -d= -f2)