chore(vllm): derive the darwin vLLM version, drop the second pin

Follow-up: VLLM_VERSION was still a hardcoded string duplicating what
VLLM_METAL_VERSION already determines. Derive it at install time from
vllm-metal's own installer (vllm_v=) at the pinned tag - one source of truth,
no second value to drift. The bumper now touches only VLLM_METAL_VERSION;
the derivation is immutable per tag, so builds stay reproducible.

Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:opus-4.8 [Claude Code]

.github/bump_vllm_metal.sh

@@ -1,13 +1,11 @@
 #!/bin/bash
-# Bump the vllm-metal pins in the vLLM backend's darwin (Apple Silicon) install
-# path. The macOS/Metal build (backend/python/vllm/install.sh, Darwin branch)
-# installs vllm-metal, which is version-locked to a specific vLLM source release.
-# Two values must move together:
-#   VLLM_METAL_VERSION -> the vllm-metal GitHub release tag (its prebuilt wheel)
-#   VLLM_VERSION       -> the vLLM source version that release builds against
-# vllm-metal declares the latter in its OWN install.sh as `vllm_v="X.Y.Z"`. This
-# script reads both from vllm-metal's latest release and rewrites them atomically
-# -- mirroring bump_vllm_wheel.sh, which does the same for the Linux cu130 wheel.
+# Bump the single vllm-metal pin (VLLM_METAL_VERSION) in the vLLM backend's
+# darwin (Apple Silicon) install path. The macOS/Metal build
+# (backend/python/vllm/install.sh, Darwin branch) installs vllm-metal, which is
+# version-locked to a specific vLLM source release. install.sh derives that vLLM
+# version at build time from vllm-metal's own installer (`vllm_v=`) at the pinned
+# tag, so there is only ONE value to bump here -- mirroring bump_vllm_wheel.sh,
+# which bumps the Linux cu130 wheel pin.
 #
 # This deliberately tracks vllm-project/vllm-metal, NOT vllm-project/vllm: the
 # darwin build can only use the exact vLLM version vllm-metal supports, so it may
@@ -42,11 +40,11 @@ set +e
 CURRENT_TAG=$(grep -oE 'VLLM_METAL_VERSION="[^"]*"' "$FILE" | head -1 | cut -d'"' -f2)
 set -e
 
-# Rewrite both pins. peter-evans/create-pull-request opens no PR on a clean tree,
-# so a no-op rewrite (already current) is safe.
+# Rewrite the single pin. install.sh derives VLLM_VERSION from this tag at build
+# time, so there is nothing else to touch. peter-evans/create-pull-request opens
+# no PR on a clean tree, so a no-op rewrite (already current) is safe.
 sed -i "$FILE" \
-    -e "s|VLLM_METAL_VERSION=\"[^\"]*\"|VLLM_METAL_VERSION=\"$LATEST_TAG\"|" \
-    -e "s|VLLM_VERSION=\"[^\"]*\"|VLLM_VERSION=\"$NEW_VLLM_VERSION\"|"
+    -e "s|VLLM_METAL_VERSION=\"[^\"]*\"|VLLM_METAL_VERSION=\"$LATEST_TAG\"|"
 
 if [ -z "$CURRENT_TAG" ]; then
     echo "Could not find VLLM_METAL_VERSION=\"...\" in $FILE." >&2

backend/python/vllm/install.sh

@@ -98,16 +98,25 @@ if [ "$(uname -s)" = "Darwin" ]; then
     # intel branch below relies on.
     pip install uv
 
-    # vllm-metal version pins -- AUTO-BUMPED by .github/bump_vllm_metal.sh, which
-    # tracks vllm-project/vllm-metal releases (NOT vllm/vllm latest). VLLM_METAL_VERSION
-    # is the vllm-metal release tag (its prebuilt wheel); VLLM_VERSION is the vLLM
-    # source version that release builds against (vllm-metal declares it as vllm_v=).
-    # They move in lockstep, so darwin can lag the Linux vllm pin
-    # (requirements-cublas13-after.txt, bumped independently against vllm/vllm) until
-    # vllm-metal supports a newer vLLM. Keep both as plain double-quoted assignments
-    # each on their own line so the bumper's sed can rewrite them.
+    # The ONLY darwin version pin -- AUTO-BUMPED by .github/bump_vllm_metal.sh,
+    # which tracks vllm-project/vllm-metal releases (NOT vllm/vllm latest). Keep
+    # it as a plain double-quoted assignment on its own line so the bumper's sed
+    # can rewrite it. Darwin therefore follows vllm-metal and can lag the Linux
+    # vllm pin (requirements-cublas13-after.txt, bumped independently against
+    # vllm/vllm) until vllm-metal supports a newer vLLM.
     VLLM_METAL_VERSION="v0.3.0.dev20260622062346"
-    VLLM_VERSION="0.23.0"
+
+    # The coupled vLLM source version is whatever this vllm-metal release builds
+    # against -- it declares it in its own installer as `vllm_v=`. Derive it from
+    # the PINNED tag rather than hardcoding a second value that could drift. The
+    # tag is immutable, so this stays reproducible across rebuilds.
+    VLLM_VERSION=$(curl -fsSL "https://raw.githubusercontent.com/vllm-project/vllm-metal/${VLLM_METAL_VERSION}/install.sh" \
+        | grep -oE 'vllm_v="[0-9]+\.[0-9]+\.[0-9]+"' | head -n1 | cut -d'"' -f2)
+    if [ -z "${VLLM_VERSION}" ]; then
+        echo "ERROR: could not derive the vLLM version from vllm-metal ${VLLM_METAL_VERSION}" >&2
+        exit 1
+    fi
+    echo "vllm-metal ${VLLM_METAL_VERSION} builds against vLLM ${VLLM_VERSION}"
 
     _vllm_src=$(mktemp -d)
     trap 'rm -rf "${_vllm_src}"' EXIT