The tools-ref defaults follow the tag too

.github/workflows/checks.yml

@@ -117,18 +117,17 @@ jobs:
             exit 1
           fi
           echo "OK: no ./ calls"
-      - name: The coordinator's sibling refs all name one tag
+      - name: Every sibling ref and tools-ref default names one tag
         run: |
           set -euo pipefail
-          tags=$(grep -oE 'PyDevices/\.github/\.github/workflows/[a-z-]+\.yml@publishing-v[0-9]+' \
-                   .github/workflows/reusable-publish-release-packages.yml \
-                 | sed 's/.*@//' | sort -u)
+          tags=$(grep -ohE '(\.yml@|default: )publishing-v[0-9]+' .github/workflows/reusable-*.yml \
+                 | sed 's/.*publishing-/publishing-/' | sort -u)
           count=$(printf '%s\n' "$tags" | grep -c .)
           if [ "$count" -ne 1 ]; then
-            echo "::error::the coordinator's sibling refs name $count tags: $(echo "$tags" | tr '\n' ' ')"
+            echo "::error::the reusables' refs name $count tags: $(echo "$tags" | tr '\n' ' ')"
             exit 1
           fi
-          echo "OK: every sibling ref is @$tags"
+          echo "OK: every ref is $tags"
 
   ruff:
     runs-on: ubuntu-latest

.github/workflows/reusable-build-pydevices-distributions.yml

@@ -10,7 +10,7 @@ on:
         required: true
         type: string
       publishing-tools-ref:
-        default: publishing-v6
+        default: publishing-v11
         type: string
 
 permissions:

.github/workflows/reusable-synchronize-mip-package.yml

@@ -33,7 +33,7 @@ on:
         # The lockfile drives a re-sync of every locked package on each run, so
         # the tools ref has to know every profile in it, not just the one being
         # published.
-        default: publishing-v6
+        default: publishing-v11
         type: string
 
 permissions:

.github/workflows/reusable-validate-pyscript-filesystem-toml.yml

@@ -15,7 +15,7 @@ on:
         default: ""
         type: string
       publishing-tools-ref:
-        default: publishing-v6
+        default: publishing-v11
         type: string
 
 permissions:

docs/publishing-automation.md

@@ -34,9 +34,12 @@ repository: a consumer's publish run dies at startup with zero jobs
 (pydevices v0.5.0, [.github#47](https://github.com/PyDevices/.github/issues/47)).
 `publishing-v11` is the fix: the siblings are named by full path at the tag's
 own name, and [`scripts/cut_publishing_tag.sh`](../scripts/cut_publishing_tag.sh)
-is the only way a tag is cut from now on — it rewrites those refs and tags
-the same commit, and the `sibling-refs` check refuses a tree where they
-disagree or use `./`.
+is the only way a tag is cut from now on — it rewrites those refs *and* the
+`publishing-tools-ref` input defaults (through which three reusables check
+out this repository's `scripts/`) and tags the same commit, and the
+`sibling-refs` check refuses a tree where any of them disagree or use `./`.
+(v11 itself still carries v6 tools-ref defaults — harmless, the scripts are
+identical — and is the last tag cut before the script covered them.)
 
 **There is no single "current" pin — a repository is on whatever tag it was
 last moved to.** As of 2026-09-22:

scripts/cut_publishing_tag.sh

@@ -24,15 +24,21 @@ git rev-parse -q --verify "refs/tags/$TAG" >/dev/null && { echo "$TAG already ex
 if grep -nE '^\s*uses:\s*\./' .github/workflows/reusable-*.yml; then
     echo "a reusable calls a sibling by ./ path; fix that first (.github#47)" >&2; exit 1
 fi
+# Two kinds of ref name a publishing tag inside the reusables: the coordinator's
+# `uses:` lines, and the `publishing-tools-ref` input defaults through which a
+# reusable checks out this repository's scripts/. Both must name the tag being
+# cut, or the tag runs another tag's tools (the v6 tools under the v11
+# coordinator, found by the 0.5.0 verification).
 sed -i -E "s#(PyDevices/\.github/\.github/workflows/[a-z-]+\.yml@)publishing-v[0-9]+#\1$TAG#g" "$COORD"
-refs=$(grep -oE 'workflows/[a-z-]+\.yml@publishing-v[0-9]+' "$COORD" | sort -u)
+sed -i -E "s#^(\s*default: )publishing-v[0-9]+\$#\1$TAG#" .github/workflows/reusable-*.yml
+refs=$(grep -ohE '(\.yml@|default: )publishing-v[0-9]+' .github/workflows/reusable-*.yml | sed 's/.*publishing-/publishing-/' | sort -u)
 echo "$refs"
-[[ "$(echo "$refs" | sed 's/.*@//' | sort -u | wc -l)" == "1" ]] || { echo "sibling refs disagree after rewrite" >&2; exit 1; }
+[[ "$(echo "$refs" | wc -l)" == "1" && "$refs" == "$TAG" ]] || { echo "refs disagree after rewrite: $(echo $refs | tr '\n' ' ')" >&2; exit 1; }
 if git diff --quiet; then
-    echo "coordinator already names $TAG; tagging HEAD"
+    echo "every ref already names $TAG; tagging HEAD"
 else
-    git add "$COORD"
-    git commit -qm "$TAG: the coordinator's sibling refs name their own tag"
+    git add .github/workflows/reusable-*.yml
+    git commit -qm "$TAG: every sibling ref and tools-ref default names its own tag"
 fi
 git tag -a "$TAG" -m "$TAG, cut by scripts/cut_publishing_tag.sh at $(git rev-parse --short HEAD)"
 git push -q origin main "$TAG"