From ac338737c969ff99c92fee7b4866e5e97670766f Mon Sep 17 00:00:00 2001
From: Brad Barnett <127794626+bdbarnett@users.noreply.github.com>
Date: Tue, 22 Sep 2026 08:15:14 -0500
Subject: [PATCH] The tools-ref defaults follow the tag too

reusable-build-pydevices-distributions, reusable-synchronize-mip-package and
reusable-validate-pyscript-filesystem-toml check this repository's scripts/
out at a publishing-tools-ref whose default was still publishing-v6, so the
v11 coordinator ran v6's build tools (identical today; found by the 0.5.0
verification). cut_publishing_tag.sh now rewrites those defaults with the
sibling refs, and the sibling-refs check covers every ref literal in the
reusables.
---
 .github/workflows/checks.yml                     | 11 +++++------
 .../reusable-build-pydevices-distributions.yml   |  2 +-
 .../reusable-synchronize-mip-package.yml         |  2 +-
 ...eusable-validate-pyscript-filesystem-toml.yml |  2 +-
 docs/publishing-automation.md                    |  9 ++++++---
 scripts/cut_publishing_tag.sh                    | 16 +++++++++++-----
 6 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 1538686..f680f43 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -117,18 +117,17 @@ jobs:
             exit 1
           fi
           echo "OK: no ./ calls"
-      - name: The coordinator's sibling refs all name one tag
+      - name: Every sibling ref and tools-ref default names one tag
         run: |
           set -euo pipefail
-          tags=$(grep -oE 'PyDevices/\.github/\.github/workflows/[a-z-]+\.yml@publishing-v[0-9]+' \
-                   .github/workflows/reusable-publish-release-packages.yml \
-                 | sed 's/.*@//' | sort -u)
+          tags=$(grep -ohE '(\.yml@|default: )publishing-v[0-9]+' .github/workflows/reusable-*.yml \
+                 | sed 's/.*publishing-/publishing-/' | sort -u)
           count=$(printf '%s\n' "$tags" | grep -c .)
           if [ "$count" -ne 1 ]; then
-            echo "::error::the coordinator's sibling refs name $count tags: $(echo "$tags" | tr '\n' ' ')"
+            echo "::error::the reusables' refs name $count tags: $(echo "$tags" | tr '\n' ' ')"
             exit 1
           fi
-          echo "OK: every sibling ref is @$tags"
+          echo "OK: every ref is $tags"
 
   ruff:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/reusable-build-pydevices-distributions.yml b/.github/workflows/reusable-build-pydevices-distributions.yml
index 0b37446..c829139 100644
--- a/.github/workflows/reusable-build-pydevices-distributions.yml
+++ b/.github/workflows/reusable-build-pydevices-distributions.yml
@@ -10,7 +10,7 @@ on:
         required: true
         type: string
       publishing-tools-ref:
-        default: publishing-v6
+        default: publishing-v11
         type: string
 
 permissions:
diff --git a/.github/workflows/reusable-synchronize-mip-package.yml b/.github/workflows/reusable-synchronize-mip-package.yml
index dfc0151..99920d8 100644
--- a/.github/workflows/reusable-synchronize-mip-package.yml
+++ b/.github/workflows/reusable-synchronize-mip-package.yml
@@ -33,7 +33,7 @@ on:
         # The lockfile drives a re-sync of every locked package on each run, so
         # the tools ref has to know every profile in it, not just the one being
         # published.
-        default: publishing-v6
+        default: publishing-v11
         type: string
 
 permissions:
diff --git a/.github/workflows/reusable-validate-pyscript-filesystem-toml.yml b/.github/workflows/reusable-validate-pyscript-filesystem-toml.yml
index 3624a53..5abcba7 100644
--- a/.github/workflows/reusable-validate-pyscript-filesystem-toml.yml
+++ b/.github/workflows/reusable-validate-pyscript-filesystem-toml.yml
@@ -15,7 +15,7 @@ on:
         default: ""
         type: string
       publishing-tools-ref:
-        default: publishing-v6
+        default: publishing-v11
         type: string
 
 permissions:
diff --git a/docs/publishing-automation.md b/docs/publishing-automation.md
index 1d20ade..71b63bc 100644
--- a/docs/publishing-automation.md
+++ b/docs/publishing-automation.md
@@ -34,9 +34,12 @@ repository: a consumer's publish run dies at startup with zero jobs
 (pydevices v0.5.0, [.github#47](https://github.com/PyDevices/.github/issues/47)).
 `publishing-v11` is the fix: the siblings are named by full path at the tag's
 own name, and [`scripts/cut_publishing_tag.sh`](../scripts/cut_publishing_tag.sh)
-is the only way a tag is cut from now on — it rewrites those refs and tags
-the same commit, and the `sibling-refs` check refuses a tree where they
-disagree or use `./`.
+is the only way a tag is cut from now on — it rewrites those refs *and* the
+`publishing-tools-ref` input defaults (through which three reusables check
+out this repository's `scripts/`) and tags the same commit, and the
+`sibling-refs` check refuses a tree where any of them disagree or use `./`.
+(v11 itself still carries v6 tools-ref defaults — harmless, the scripts are
+identical — and is the last tag cut before the script covered them.)
 
 **There is no single "current" pin — a repository is on whatever tag it was
 last moved to.** As of 2026-09-22:
diff --git a/scripts/cut_publishing_tag.sh b/scripts/cut_publishing_tag.sh
index c0e36f7..818338e 100755
--- a/scripts/cut_publishing_tag.sh
+++ b/scripts/cut_publishing_tag.sh
@@ -24,15 +24,21 @@ git rev-parse -q --verify "refs/tags/$TAG" >/dev/null && { echo "$TAG already ex
 if grep -nE '^\s*uses:\s*\./' .github/workflows/reusable-*.yml; then
     echo "a reusable calls a sibling by ./ path; fix that first (.github#47)" >&2; exit 1
 fi
+# Two kinds of ref name a publishing tag inside the reusables: the coordinator's
+# `uses:` lines, and the `publishing-tools-ref` input defaults through which a
+# reusable checks out this repository's scripts/. Both must name the tag being
+# cut, or the tag runs another tag's tools (the v6 tools under the v11
+# coordinator, found by the 0.5.0 verification).
 sed -i -E "s#(PyDevices/\.github/\.github/workflows/[a-z-]+\.yml@)publishing-v[0-9]+#\1$TAG#g" "$COORD"
-refs=$(grep -oE 'workflows/[a-z-]+\.yml@publishing-v[0-9]+' "$COORD" | sort -u)
+sed -i -E "s#^(\s*default: )publishing-v[0-9]+\$#\1$TAG#" .github/workflows/reusable-*.yml
+refs=$(grep -ohE '(\.yml@|default: )publishing-v[0-9]+' .github/workflows/reusable-*.yml | sed 's/.*publishing-/publishing-/' | sort -u)
 echo "$refs"
-[[ "$(echo "$refs" | sed 's/.*@//' | sort -u | wc -l)" == "1" ]] || { echo "sibling refs disagree after rewrite" >&2; exit 1; }
+[[ "$(echo "$refs" | wc -l)" == "1" && "$refs" == "$TAG" ]] || { echo "refs disagree after rewrite: $(echo $refs | tr '\n' ' ')" >&2; exit 1; }
 if git diff --quiet; then
-    echo "coordinator already names $TAG; tagging HEAD"
+    echo "every ref already names $TAG; tagging HEAD"
 else
-    git add "$COORD"
-    git commit -qm "$TAG: the coordinator's sibling refs name their own tag"
+    git add .github/workflows/reusable-*.yml
+    git commit -qm "$TAG: every sibling ref and tools-ref default names its own tag"
 fi
 git tag -a "$TAG" -m "$TAG, cut by scripts/cut_publishing_tag.sh at $(git rev-parse --short HEAD)"
 git push -q origin main "$TAG"