ci: group dependabot PRs and allow manual workflow runs

.github/dependabot.yml

@@ -9,7 +9,15 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      nuget:
+        patterns:
+          - "*"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -8,6 +8,7 @@ on:
     branches:
       - develop
   pull_request:
+  workflow_dispatch:
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}

.github/workflows/codeql.yml

@@ -13,6 +13,7 @@ on:
       - develop
   schedule:
     - cron: '0 6 * * 1' # Every Monday at 06:00 UTC
+  workflow_dispatch:
 
 jobs:
   analyze:

.github/workflows/publish.yml

@@ -4,6 +4,14 @@ on:
   push:
     tags:
       - 'v*'
+  # Allow re-running a release on demand (e.g. after a transient NuGet/MCP Registry failure).
+  # The tag must already exist: every step below derives the version from it.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing release tag to publish (e.g. v1.0.3)'
+        required: true
+        type: string
 
 permissions:
   contents: write
@@ -14,16 +22,29 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
+      - name: Validate tag input
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          TAG: ${{ github.event.inputs.tag }}
+        run: |
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "::error::'$TAG' is not a valid release tag (expected e.g. v1.0.3 or v1.0.0-rc.1)."
+            exit 1
+          fi
+
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          ref: ${{ github.event.inputs.tag || github.ref }}
 
       - name: Extract version from tag
         id: get_version
+        env:
+          TAG: ${{ github.event.inputs.tag || github.ref_name }}
         run: |
-          VERSION=${GITHUB_REF_NAME#v}
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Version: $VERSION"
+          echo "tag=$TAG" >> $GITHUB_OUTPUT
+          echo "version=${TAG#v}" >> $GITHUB_OUTPUT
+          echo "Tag: $TAG / Version: ${TAG#v}"
 
       - name: Update Directory.Build.props version
         run: |
@@ -67,10 +88,11 @@ jobs:
         uses: softprops/action-gh-release@v3
         with:
           files: artifacts/*
+          tag_name: ${{ steps.get_version.outputs.tag }}
           generate_release_notes: true
           draft: false
           # Treat a tag with a pre-release suffix (e.g. v1.0.0-rc.1) as a pre-release.
-          prerelease: ${{ contains(github.ref_name, '-') }}
+          prerelease: ${{ contains(steps.get_version.outputs.tag, '-') }}
 
       - name: Install mcp-publisher
         run: |