From 4da743590a4fc042f2a28a96f13ed25b0fe8c727 Mon Sep 17 00:00:00 2001
From: Josh Vaughen <josh@vaughen.net>
Date: Mon, 14 Sep 2026 11:55:54 -0700
Subject: [PATCH] fix(sync): chain names the caller's file, the @ref cut before
 the path

---
 .github/chain-file.sh      | 24 ++++++++++++++++++++++++
 .github/workflows/ci.yml   |  1 +
 .github/workflows/sync.yml |  4 ++--
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 .github/chain-file.sh

diff --git a/.github/chain-file.sh b/.github/chain-file.sh
new file mode 100644
index 0000000..1b37448
--- /dev/null
+++ b/.github/chain-file.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+# chain-file.sh "$GITHUB_WORKFLOW_REF": print the caller's own workflow file, the argument
+# to `gh workflow run` when a run chains the next one.
+#
+# The ref is owner/repo/.github/workflows/<file>@<ref>, and <ref> holds slashes of its own
+# (refs/heads/main), so the @ and everything after it come off before the path does.
+#
+# `--check` runs this file's own cases instead, so the rule and its proof stay together.
+set -eu
+
+chain_file() {
+  path="${1%%@*}"
+  printf '%s\n' "${path##*/}"
+}
+
+if [ "${1-}" = --check ]; then
+  [ "$(chain_file 'katoptra/dropbox/.github/workflows/sync.yml@refs/heads/main')" = sync.yml ]
+  [ "$(chain_file 'katoptra/ctan/.github/workflows/hourly.yml@refs/heads/josh/topic')" = hourly.yml ]
+  [ "$(chain_file 'o/r/.github/workflows/sync.yml@81fb6ee34abc7703087cfe4a303263febc912c6f')" = sync.yml ]
+  echo "chain-file: PASS"
+  exit 0
+fi
+
+chain_file "$1"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f42d48..59dd535 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,6 +20,7 @@ jobs:
         if: matrix.variant == 'rsync'
         run: |
           sh .github/validate-vars.sh --check
+          sh .github/chain-file.sh --check
           sh docker/gpg-gate-check.sh
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       # Layers cached in Actions, one scope per variant; release reads the same scope, so a
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 0ed63d6..c13b1c6 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -70,9 +70,9 @@ jobs:
         if: success()
         env:
           GH_TOKEN: ${{ github.token }}
-        # The caller's own file name, whatever it is; workflow_ref is owner/repo/.github/workflows/<file>@<ref>.
+        # The caller's own file name, whatever it is, cut from GITHUB_WORKFLOW_REF by chain-file.sh.
         run: |
           if [ -f .run/chain ]; then
-            f="${GITHUB_WORKFLOW_REF##*/}"; gh workflow run "${f%%@*}" --ref "$GITHUB_REF_NAME"
+            gh workflow run "$(sh .lib/.github/chain-file.sh "$GITHUB_WORKFLOW_REF")" --ref "$GITHUB_REF_NAME"
             echo "chained: next run queued" >> "$GITHUB_STEP_SUMMARY"
           fi