From 278163c6bec86d4d92bf75d8e3b91dc300c8bc17 Mon Sep 17 00:00:00 2001
From: Randy Fay <randy@randyfay.com>
Date: Thu, 30 Jul 2026 11:28:54 -0600
Subject: [PATCH 1/3] feat(vscode): add Go extension by default, DRY the
 extensions list across templates

Enables golang.go by default in all three templates and pre-installs gopls
via Homebrew alongside the existing go/golangci-lint so the extension
doesn't need to fetch it on first use.

The vscode_extensions variable was identical in all three template.tf
files. Extracted it into shared/vscode-extensions.tf, vendored into each
template directory the same way modules/claude-remote-control already is
(coder templates push and CI only ever see one template directory, so a
relative ../shared reference wouldn't survive. make push-template-* /
validate / test-templates now depend on a new sync-shared target so the
vendoring happens automatically.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
EOF
)
---
 CLAUDE.md                           | 22 +++++++++++++---------
 Makefile                            | 20 +++++++++++++++-----
 drupal-contrib/template.tf          | 25 -------------------------
 drupal-contrib/vscode-extensions.tf | 25 +++++++++++++++++++++++++
 drupal-core/template.tf             | 25 -------------------------
 drupal-core/vscode-extensions.tf    | 25 +++++++++++++++++++++++++
 freeform/template.tf                | 25 -------------------------
 freeform/vscode-extensions.tf       | 25 +++++++++++++++++++++++++
 image/Dockerfile                    |  1 +
 shared/vscode-extensions.tf         | 25 +++++++++++++++++++++++++
 10 files changed, 129 insertions(+), 89 deletions(-)
 create mode 100644 drupal-contrib/vscode-extensions.tf
 create mode 100644 drupal-core/vscode-extensions.tf
 create mode 100644 freeform/vscode-extensions.tf
 create mode 100644 shared/vscode-extensions.tf

diff --git a/CLAUDE.md b/CLAUDE.md
index 8a8cdca..4c91225 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -59,19 +59,23 @@ Run these before every push to avoid CI failures:
 # Terraform formatting (CI runs terraform fmt -check -recursive)
 terraform fmt -recursive
 
-# Terraform validation for each template you touched
-terraform -chdir=drupal-core init -backend=false && terraform -chdir=drupal-core validate
-terraform -chdir=drupal-contrib init -backend=false && terraform -chdir=drupal-contrib validate
-terraform -chdir=freeform init -backend=false && terraform -chdir=freeform validate
-
-# Terraform tests (plan-level, no real infrastructure)
-terraform -chdir=drupal-core test
-terraform -chdir=drupal-contrib test
-terraform -chdir=freeform test
+# Vendor shared assets, then validate + test every template
+make validate
+make test-templates
 ```
 
 `terraform fmt -recursive` must be run from the repo root. It is non-destructive (rewrites in place) and the CI check fails with exit code 3 if any file is not formatted.
 
+**Always use `make validate` / `make test-templates`, not raw `terraform validate`/`terraform test` run directly in a template directory.** Both targets depend on `make sync-shared`, which vendors `modules/claude-remote-control` and `shared/vscode-extensions.tf` into each template directory first (see "Shared Terraform Assets" below). Running `terraform validate`/`test` directly against a template dir will happily validate against a stale vendored copy and miss the fact that it's out of sync with the canonical source.
+
+## Shared Terraform Assets
+
+Some Terraform config (currently `modules/claude-remote-control` and `shared/vscode-extensions.tf`) is shared across all three templates but must exist as a **physical copy inside each template directory** — `coder templates push` and CI's `terraform validate`/`test` only ever operate on a single template directory, so a relative `../modules` or `../shared` reference would not survive the push and would not be visible to CI.
+
+- **Edit only the canonical source**: `modules/claude-remote-control/` or `shared/vscode-extensions.tf` at the repo root. Never hand-edit the vendored copies (`<template>/modules/claude-remote-control/`, `<template>/vscode-extensions.tf`) — they get overwritten the next time anyone runs the sync.
+- **Always resync through `make`**, never by hand-copying: `make sync-shared` (or `make sync-claude-module` / `make sync-vscode-extensions` individually). `make validate`, `make test-templates`, and every `make push-template-*` / `make push-all-templates` target already depend on `sync-shared`, so day-to-day you rarely need to invoke it directly.
+- **Commit the vendored copies.** They are tracked files, not build artifacts — CI validates each template directory standalone with no `make` step, so the vendored copies must already be correct and committed for CI to pass.
+
 ## Working with Coder Workspaces via SSH
 
 After running `coder config-ssh --yes`, workspaces are available as SSH hosts named `<workspace>.coder`. Use `scp` to copy files in or out, then `ssh` to execute scripts non-interactively:
diff --git a/Makefile b/Makefile
index 6f1e46f..4b1e2b1 100644
--- a/Makefile
+++ b/Makefile
@@ -112,8 +112,18 @@ sync-claude-module: ## Vendor modules/claude-remote-control into each template d
 	done
 	@echo "Synced modules/claude-remote-control into: $(TEMPLATES)"
 
+.PHONY: sync-vscode-extensions
+sync-vscode-extensions: ## Vendor shared/vscode-extensions.tf into each template dir (same reason as sync-claude-module: push only bundles the given --directory)
+	@for t in $(TEMPLATES); do \
+		cp shared/vscode-extensions.tf $$t/vscode-extensions.tf; \
+	done
+	@echo "Synced shared/vscode-extensions.tf into: $(TEMPLATES)"
+
+.PHONY: sync-shared
+sync-shared: sync-claude-module sync-vscode-extensions ## Vendor all shared Terraform assets (modules + vscode-extensions.tf) into each template dir
+
 .PHONY: validate
-validate: sync-claude-module ## Validate all Terraform templates (requires terraform in PATH)
+validate: sync-shared ## Validate all Terraform templates (requires terraform in PATH)
 	@for t in $(TEMPLATES); do \
 		echo "--- Validating $$t ---"; \
 		(cd $$t && terraform init -backend=false -input=false -no-color && terraform validate -no-color) || exit 1; \
@@ -125,7 +135,7 @@ fmt-check: ## Check Terraform formatting across all templates
 	terraform fmt -check -recursive
 
 .PHONY: test-templates
-test-templates: sync-claude-module ## Run Terraform mock unit tests for all templates (requires terraform in PATH)
+test-templates: sync-shared ## Run Terraform mock unit tests for all templates (requires terraform in PATH)
 	@for t in $(TEMPLATES); do \
 		echo "--- Testing $$t ---"; \
 		(cd $$t && terraform test) || exit 1; \
@@ -170,15 +180,15 @@ info: ## Show image and template information
 # --- Template push targets ---
 
 .PHONY: push-template-drupal-core
-push-template-drupal-core: sync-claude-module ## Push drupal-core template to Coder
+push-template-drupal-core: sync-shared ## Push drupal-core template to Coder
 	$(call push_template,drupal-core)
 
 .PHONY: push-template-drupal-contrib
-push-template-drupal-contrib: sync-claude-module ## Push drupal-contrib template to Coder
+push-template-drupal-contrib: sync-shared ## Push drupal-contrib template to Coder
 	$(call push_template,drupal-contrib)
 
 .PHONY: push-template-freeform
-push-template-freeform: sync-claude-module ## Push freeform template to Coder
+push-template-freeform: sync-shared ## Push freeform template to Coder
 	$(call push_template,freeform)
 
 .PHONY: push-all-templates
diff --git a/drupal-contrib/template.tf b/drupal-contrib/template.tf
index 3d78900..602ea09 100644
--- a/drupal-contrib/template.tf
+++ b/drupal-contrib/template.tf
@@ -224,31 +224,6 @@ locals {
   workspace_image_registry_base = replace(local.registry_without_version, ":latest", "")
 }
 
-variable "vscode_extensions" {
-  description = "List of VS Code extensions to offer in the workspace creation UI"
-  type = list(object({
-    id      = string
-    name    = string
-    default = bool
-  }))
-  default = [
-    { id = "xdebug.php-debug", name = "PHP Debug", default = true },
-    { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
-    { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
-    { id = "esbenp.prettier-vscode", name = "Prettier", default = true },
-    { id = "sanderronde.phpstan-vscode", name = "PHPStan", default = true },
-    { id = "streetsidesoftware.code-spell-checker", name = "Code Spell Checker", default = true },
-    { id = "stylelint.vscode-stylelint", name = "Stylelint", default = true },
-    { id = "valeryanm.vscode-phpsab", name = "PHPSAB", default = true },
-    { id = "biati.ddev-manager", name = "DDEV Manager", default = true },
-    { id = "deque-systems.vscode-axe-linter", name = "Axe Linter", default = false },
-    { id = "andrewdavidblum.drupal-smart-snippets", name = "Drupal Smart Snippets", default = false },
-    { id = "redhat.vscode-yaml", name = "YAML", default = false },
-    { id = "sleistner.vscode-fileutils", name = "File Utils", default = false },
-    { id = "GitHub.vscode-pull-request-github", name = "GitHub Pull Requests", default = false },
-  ]
-}
-
 variable "workspace_image_registry" {
   description = "Docker registry URL for the workspace base image (without tag, version is added automatically)"
   type        = string
diff --git a/drupal-contrib/vscode-extensions.tf b/drupal-contrib/vscode-extensions.tf
new file mode 100644
index 0000000..5f8ef46
--- /dev/null
+++ b/drupal-contrib/vscode-extensions.tf
@@ -0,0 +1,25 @@
+variable "vscode_extensions" {
+  description = "List of VS Code extensions to offer in the workspace creation UI"
+  type = list(object({
+    id      = string
+    name    = string
+    default = bool
+  }))
+  default = [
+    { id = "xdebug.php-debug", name = "PHP Debug", default = true },
+    { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
+    { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
+    { id = "esbenp.prettier-vscode", name = "Prettier", default = true },
+    { id = "sanderronde.phpstan-vscode", name = "PHPStan", default = true },
+    { id = "streetsidesoftware.code-spell-checker", name = "Code Spell Checker", default = true },
+    { id = "stylelint.vscode-stylelint", name = "Stylelint", default = true },
+    { id = "valeryanm.vscode-phpsab", name = "PHPSAB", default = true },
+    { id = "biati.ddev-manager", name = "DDEV Manager", default = true },
+    { id = "golang.go", name = "Go", default = true },
+    { id = "deque-systems.vscode-axe-linter", name = "Axe Linter", default = false },
+    { id = "andrewdavidblum.drupal-smart-snippets", name = "Drupal Smart Snippets", default = false },
+    { id = "redhat.vscode-yaml", name = "YAML", default = false },
+    { id = "sleistner.vscode-fileutils", name = "File Utils", default = false },
+    { id = "GitHub.vscode-pull-request-github", name = "GitHub Pull Requests", default = false },
+  ]
+}
diff --git a/drupal-core/template.tf b/drupal-core/template.tf
index 003e893..ec349bc 100644
--- a/drupal-core/template.tf
+++ b/drupal-core/template.tf
@@ -224,31 +224,6 @@ locals {
   workspace_image_registry_base = replace(local.registry_without_version, ":latest", "")
 }
 
-variable "vscode_extensions" {
-  description = "List of VS Code extensions to offer in the workspace creation UI"
-  type = list(object({
-    id      = string
-    name    = string
-    default = bool
-  }))
-  default = [
-    { id = "xdebug.php-debug", name = "PHP Debug", default = true },
-    { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
-    { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
-    { id = "esbenp.prettier-vscode", name = "Prettier", default = true },
-    { id = "sanderronde.phpstan-vscode", name = "PHPStan", default = true },
-    { id = "streetsidesoftware.code-spell-checker", name = "Code Spell Checker", default = true },
-    { id = "stylelint.vscode-stylelint", name = "Stylelint", default = true },
-    { id = "valeryanm.vscode-phpsab", name = "PHPSAB", default = true },
-    { id = "biati.ddev-manager", name = "DDEV Manager", default = true },
-    { id = "deque-systems.vscode-axe-linter", name = "Axe Linter", default = false },
-    { id = "andrewdavidblum.drupal-smart-snippets", name = "Drupal Smart Snippets", default = false },
-    { id = "redhat.vscode-yaml", name = "YAML", default = false },
-    { id = "sleistner.vscode-fileutils", name = "File Utils", default = false },
-    { id = "GitHub.vscode-pull-request-github", name = "GitHub Pull Requests", default = false },
-  ]
-}
-
 variable "workspace_image_registry" {
   description = "Docker registry URL for the workspace base image (without tag, version is added automatically)"
   type        = string
diff --git a/drupal-core/vscode-extensions.tf b/drupal-core/vscode-extensions.tf
new file mode 100644
index 0000000..5f8ef46
--- /dev/null
+++ b/drupal-core/vscode-extensions.tf
@@ -0,0 +1,25 @@
+variable "vscode_extensions" {
+  description = "List of VS Code extensions to offer in the workspace creation UI"
+  type = list(object({
+    id      = string
+    name    = string
+    default = bool
+  }))
+  default = [
+    { id = "xdebug.php-debug", name = "PHP Debug", default = true },
+    { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
+    { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
+    { id = "esbenp.prettier-vscode", name = "Prettier", default = true },
+    { id = "sanderronde.phpstan-vscode", name = "PHPStan", default = true },
+    { id = "streetsidesoftware.code-spell-checker", name = "Code Spell Checker", default = true },
+    { id = "stylelint.vscode-stylelint", name = "Stylelint", default = true },
+    { id = "valeryanm.vscode-phpsab", name = "PHPSAB", default = true },
+    { id = "biati.ddev-manager", name = "DDEV Manager", default = true },
+    { id = "golang.go", name = "Go", default = true },
+    { id = "deque-systems.vscode-axe-linter", name = "Axe Linter", default = false },
+    { id = "andrewdavidblum.drupal-smart-snippets", name = "Drupal Smart Snippets", default = false },
+    { id = "redhat.vscode-yaml", name = "YAML", default = false },
+    { id = "sleistner.vscode-fileutils", name = "File Utils", default = false },
+    { id = "GitHub.vscode-pull-request-github", name = "GitHub Pull Requests", default = false },
+  ]
+}
diff --git a/freeform/template.tf b/freeform/template.tf
index 2ce77ce..3bf52f1 100644
--- a/freeform/template.tf
+++ b/freeform/template.tf
@@ -113,31 +113,6 @@ locals {
   )
 }
 
-variable "vscode_extensions" {
-  description = "List of VS Code extensions to offer in the workspace creation UI"
-  type = list(object({
-    id      = string
-    name    = string
-    default = bool
-  }))
-  default = [
-    { id = "xdebug.php-debug", name = "PHP Debug", default = true },
-    { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
-    { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
-    { id = "esbenp.prettier-vscode", name = "Prettier", default = true },
-    { id = "sanderronde.phpstan-vscode", name = "PHPStan", default = true },
-    { id = "streetsidesoftware.code-spell-checker", name = "Code Spell Checker", default = true },
-    { id = "stylelint.vscode-stylelint", name = "Stylelint", default = true },
-    { id = "valeryanm.vscode-phpsab", name = "PHPSAB", default = true },
-    { id = "biati.ddev-manager", name = "DDEV Manager", default = true },
-    { id = "deque-systems.vscode-axe-linter", name = "Axe Linter", default = false },
-    { id = "andrewdavidblum.drupal-smart-snippets", name = "Drupal Smart Snippets", default = false },
-    { id = "redhat.vscode-yaml", name = "YAML", default = false },
-    { id = "sleistner.vscode-fileutils", name = "File Utils", default = false },
-    { id = "GitHub.vscode-pull-request-github", name = "GitHub Pull Requests", default = false },
-  ]
-}
-
 variable "workspace_image_registry" {
   description = "Docker registry URL for the workspace base image (without tag)"
   type        = string
diff --git a/freeform/vscode-extensions.tf b/freeform/vscode-extensions.tf
new file mode 100644
index 0000000..5f8ef46
--- /dev/null
+++ b/freeform/vscode-extensions.tf
@@ -0,0 +1,25 @@
+variable "vscode_extensions" {
+  description = "List of VS Code extensions to offer in the workspace creation UI"
+  type = list(object({
+    id      = string
+    name    = string
+    default = bool
+  }))
+  default = [
+    { id = "xdebug.php-debug", name = "PHP Debug", default = true },
+    { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
+    { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
+    { id = "esbenp.prettier-vscode", name = "Prettier", default = true },
+    { id = "sanderronde.phpstan-vscode", name = "PHPStan", default = true },
+    { id = "streetsidesoftware.code-spell-checker", name = "Code Spell Checker", default = true },
+    { id = "stylelint.vscode-stylelint", name = "Stylelint", default = true },
+    { id = "valeryanm.vscode-phpsab", name = "PHPSAB", default = true },
+    { id = "biati.ddev-manager", name = "DDEV Manager", default = true },
+    { id = "golang.go", name = "Go", default = true },
+    { id = "deque-systems.vscode-axe-linter", name = "Axe Linter", default = false },
+    { id = "andrewdavidblum.drupal-smart-snippets", name = "Drupal Smart Snippets", default = false },
+    { id = "redhat.vscode-yaml", name = "YAML", default = false },
+    { id = "sleistner.vscode-fileutils", name = "File Utils", default = false },
+    { id = "GitHub.vscode-pull-request-github", name = "GitHub Pull Requests", default = false },
+  ]
+}
diff --git a/image/Dockerfile b/image/Dockerfile
index cc6c24d..2a9bbf4 100644
--- a/image/Dockerfile
+++ b/image/Dockerfile
@@ -183,6 +183,7 @@ RUN mkdir -p "$HOMEBREW_CACHE" && /home/linuxbrew/.linuxbrew/bin/brew install \
   claude-code \
   go \
   golangci-lint \
+  gopls \
   yq \
   zellij
 
diff --git a/shared/vscode-extensions.tf b/shared/vscode-extensions.tf
new file mode 100644
index 0000000..5f8ef46
--- /dev/null
+++ b/shared/vscode-extensions.tf
@@ -0,0 +1,25 @@
+variable "vscode_extensions" {
+  description = "List of VS Code extensions to offer in the workspace creation UI"
+  type = list(object({
+    id      = string
+    name    = string
+    default = bool
+  }))
+  default = [
+    { id = "xdebug.php-debug", name = "PHP Debug", default = true },
+    { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
+    { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
+    { id = "esbenp.prettier-vscode", name = "Prettier", default = true },
+    { id = "sanderronde.phpstan-vscode", name = "PHPStan", default = true },
+    { id = "streetsidesoftware.code-spell-checker", name = "Code Spell Checker", default = true },
+    { id = "stylelint.vscode-stylelint", name = "Stylelint", default = true },
+    { id = "valeryanm.vscode-phpsab", name = "PHPSAB", default = true },
+    { id = "biati.ddev-manager", name = "DDEV Manager", default = true },
+    { id = "golang.go", name = "Go", default = true },
+    { id = "deque-systems.vscode-axe-linter", name = "Axe Linter", default = false },
+    { id = "andrewdavidblum.drupal-smart-snippets", name = "Drupal Smart Snippets", default = false },
+    { id = "redhat.vscode-yaml", name = "YAML", default = false },
+    { id = "sleistner.vscode-fileutils", name = "File Utils", default = false },
+    { id = "GitHub.vscode-pull-request-github", name = "GitHub Pull Requests", default = false },
+  ]
+}

From 5b80223dcf53927c95520556bfa7f49447f32f57 Mon Sep 17 00:00:00 2001
From: Randy Fay <randy@randyfay.com>
Date: Thu, 30 Jul 2026 11:32:48 -0600
Subject: [PATCH 2/3] docs: prefer file-based commit messages and PR bodies
 over inline heredocs

An inline gh pr create --body heredoc containing an apostrophe broke shell
quoting earlier in this session. Document git commit -F / gh pr create
--body-file as the standard instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 CLAUDE.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index 4c91225..5a76542 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -50,6 +50,7 @@ The `freeform` template is unique: it keeps ddev-router running so multiple DDEV
 ## Tool Preferences
 
 - Use `jq` (not `python3 -m json.tool`) for JSON pretty-printing and querying
+- For `git commit -m` and `gh pr create --body`, write the message to a file first (e.g. under the scratchpad directory) and pass it via `git commit -F <file>` / `gh pr create --body-file <file>`, rather than inlining a heredoc on the command line. Multi-paragraph messages containing backticks, apostrophes, or other shell-special characters reliably break inline heredoc quoting.
 
 ## Before Pushing / Pre-push Checklist
 

From 2db6766a110e8b72479533a50ec86262ecb745ea Mon Sep 17 00:00:00 2001
From: Randy Fay <randy@randyfay.com>
Date: Thu, 30 Jul 2026 13:03:35 -0600
Subject: [PATCH 3/3] fix(vscode): stop Coder from pinning the
 vscode_extensions default stale

Coder pins the submitted value of any root-level Terraform `variable` the
first time a template is pushed, and reuses that pinned value on later
pushes instead of re-reading the .tf file's default unless --variable is
passed again. vscode_extensions was a `variable`, so adding golang.go to
its default had no effect on real builds: verified on staging that a
workspace built from the updated template still rejected "golang.go" as
an invalid option, even with the parameter value passed explicitly.

Switch shared/vscode-extensions.tf from a `variable` to a `locals` block
(recomputed fresh every plan, nothing for Coder to pin) and update the
var.vscode_extensions references to local.vscode_extensions in all three
templates. Verified by pushing freeform as an inactive staging version
and creating a disposable workspace pinned to it: golang.go was accepted
and installed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 drupal-contrib/template.tf          |  4 ++--
 drupal-contrib/vscode-extensions.tf | 15 +++++++--------
 drupal-core/template.tf             |  4 ++--
 drupal-core/vscode-extensions.tf    | 15 +++++++--------
 freeform/template.tf                |  4 ++--
 freeform/vscode-extensions.tf       | 15 +++++++--------
 shared/vscode-extensions.tf         | 15 +++++++--------
 7 files changed, 34 insertions(+), 38 deletions(-)

diff --git a/drupal-contrib/template.tf b/drupal-contrib/template.tf
index 602ea09..1f56de0 100644
--- a/drupal-contrib/template.tf
+++ b/drupal-contrib/template.tf
@@ -190,12 +190,12 @@ data "coder_parameter" "vscode_extensions" {
   description  = "Select extensions to enable in VS Code for Web"
   type         = "list(string)"
   form_type    = "multi-select"
-  default      = jsonencode([for e in var.vscode_extensions : e.id if e.default])
+  default      = jsonencode([for e in local.vscode_extensions : e.id if e.default])
   mutable      = true
   order        = 100
 
   dynamic "option" {
-    for_each = var.vscode_extensions
+    for_each = local.vscode_extensions
     content {
       name  = option.value.name
       value = option.value.id
diff --git a/drupal-contrib/vscode-extensions.tf b/drupal-contrib/vscode-extensions.tf
index 5f8ef46..428087f 100644
--- a/drupal-contrib/vscode-extensions.tf
+++ b/drupal-contrib/vscode-extensions.tf
@@ -1,11 +1,10 @@
-variable "vscode_extensions" {
-  description = "List of VS Code extensions to offer in the workspace creation UI"
-  type = list(object({
-    id      = string
-    name    = string
-    default = bool
-  }))
-  default = [
+locals {
+  # Deliberately a `locals`, not a `variable`: Coder pins the submitted value of any
+  # root-level `variable` block server-side the first time a template is pushed, and
+  # reuses that pinned value on later pushes instead of re-reading this file's list
+  # unless `--variable vscode_extensions=...` is passed again. `locals` are recomputed
+  # fresh on every plan, so there is nothing for Coder to pin.
+  vscode_extensions = [
     { id = "xdebug.php-debug", name = "PHP Debug", default = true },
     { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
     { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
diff --git a/drupal-core/template.tf b/drupal-core/template.tf
index ec349bc..4703c0b 100644
--- a/drupal-core/template.tf
+++ b/drupal-core/template.tf
@@ -172,12 +172,12 @@ data "coder_parameter" "vscode_extensions" {
   description  = "Select extensions to enable in VS Code for Web"
   type         = "list(string)"
   form_type    = "multi-select"
-  default      = jsonencode([for e in var.vscode_extensions : e.id if e.default])
+  default      = jsonencode([for e in local.vscode_extensions : e.id if e.default])
   mutable      = true
   order        = 100
 
   dynamic "option" {
-    for_each = var.vscode_extensions
+    for_each = local.vscode_extensions
     content {
       name  = option.value.name
       value = option.value.id
diff --git a/drupal-core/vscode-extensions.tf b/drupal-core/vscode-extensions.tf
index 5f8ef46..428087f 100644
--- a/drupal-core/vscode-extensions.tf
+++ b/drupal-core/vscode-extensions.tf
@@ -1,11 +1,10 @@
-variable "vscode_extensions" {
-  description = "List of VS Code extensions to offer in the workspace creation UI"
-  type = list(object({
-    id      = string
-    name    = string
-    default = bool
-  }))
-  default = [
+locals {
+  # Deliberately a `locals`, not a `variable`: Coder pins the submitted value of any
+  # root-level `variable` block server-side the first time a template is pushed, and
+  # reuses that pinned value on later pushes instead of re-reading this file's list
+  # unless `--variable vscode_extensions=...` is passed again. `locals` are recomputed
+  # fresh on every plan, so there is nothing for Coder to pin.
+  vscode_extensions = [
     { id = "xdebug.php-debug", name = "PHP Debug", default = true },
     { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
     { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
diff --git a/freeform/template.tf b/freeform/template.tf
index 3bf52f1..3f4092d 100644
--- a/freeform/template.tf
+++ b/freeform/template.tf
@@ -82,12 +82,12 @@ data "coder_parameter" "vscode_extensions" {
   description  = "Select extensions to enable in VS Code for Web"
   type         = "list(string)"
   form_type    = "multi-select"
-  default      = jsonencode([for e in var.vscode_extensions : e.id if e.default])
+  default      = jsonencode([for e in local.vscode_extensions : e.id if e.default])
   mutable      = true
   order        = 100
 
   dynamic "option" {
-    for_each = var.vscode_extensions
+    for_each = local.vscode_extensions
     content {
       name  = option.value.name
       value = option.value.id
diff --git a/freeform/vscode-extensions.tf b/freeform/vscode-extensions.tf
index 5f8ef46..428087f 100644
--- a/freeform/vscode-extensions.tf
+++ b/freeform/vscode-extensions.tf
@@ -1,11 +1,10 @@
-variable "vscode_extensions" {
-  description = "List of VS Code extensions to offer in the workspace creation UI"
-  type = list(object({
-    id      = string
-    name    = string
-    default = bool
-  }))
-  default = [
+locals {
+  # Deliberately a `locals`, not a `variable`: Coder pins the submitted value of any
+  # root-level `variable` block server-side the first time a template is pushed, and
+  # reuses that pinned value on later pushes instead of re-reading this file's list
+  # unless `--variable vscode_extensions=...` is passed again. `locals` are recomputed
+  # fresh on every plan, so there is nothing for Coder to pin.
+  vscode_extensions = [
     { id = "xdebug.php-debug", name = "PHP Debug", default = true },
     { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
     { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },
diff --git a/shared/vscode-extensions.tf b/shared/vscode-extensions.tf
index 5f8ef46..428087f 100644
--- a/shared/vscode-extensions.tf
+++ b/shared/vscode-extensions.tf
@@ -1,11 +1,10 @@
-variable "vscode_extensions" {
-  description = "List of VS Code extensions to offer in the workspace creation UI"
-  type = list(object({
-    id      = string
-    name    = string
-    default = bool
-  }))
-  default = [
+locals {
+  # Deliberately a `locals`, not a `variable`: Coder pins the submitted value of any
+  # root-level `variable` block server-side the first time a template is pushed, and
+  # reuses that pinned value on later pushes instead of re-reading this file's list
+  # unless `--variable vscode_extensions=...` is passed again. `locals` are recomputed
+  # fresh on every plan, so there is nothing for Coder to pin.
+  vscode_extensions = [
     { id = "xdebug.php-debug", name = "PHP Debug", default = true },
     { id = "bmewburn.vscode-intelephense-client", name = "Intelephense", default = true },
     { id = "dbaeumer.vscode-eslint", name = "ESLint", default = true },