From 544e9b9b61c015291916907aa8309cf758324d03 Mon Sep 17 00:00:00 2001
From: Joseph Mearman <joseph@mearman.co.uk>
Date: Thu, 22 Oct 2026 12:10:13 +0100
Subject: [PATCH] ci: pin the registry action to the release that retries the
 version check

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c032e562..4269c8e7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -237,5 +237,5 @@ jobs:
           git fetch --depth=1 origin "refs/tags/${REGISTRY_REF}"
           git show FETCH_HEAD:server.json > server.json
       # Pinned to the commit of the release, not the moving major tag: GitHub's secure use guidance is a full-length SHA, since a tag can be moved, and this step holds the registry publishing identity. Dependabot's github-actions updates keep the pin current.
-      - uses: ExaDev/mcp-registry-publish@b8148f254d6788ac7fd817a0bd8d8f0abe4784d5 # v1.0.3
+      - uses: ExaDev/mcp-registry-publish@438589653ab51681ce140c2dec1ee58798ed16cd # v1.0.4