[kixelated]

Problem

release still runs release-plz release-pr before publishing. The recorded release run consequently opened a stale PR for versions that the same run published afterward.

Approach

Backport only the release recipe from moq-dev/moq#7818, which landed on main as baed05a9a0. Publish first, then propose the next release; a publishing failure stops before PR creation. This follows the main-first backport rule.

Impact

• Public API and wire: none.
• Only rs/justfile's release recipe and its comment change. No package versions, Rust test/lint recipes, workflows, permissions, or credentials change. The planned Rust OIDC migration can keep calling this recipe.

Alternatives

Port the recipe alone rather than cherry-pick main's quest bookkeeping or newer build recipes.

Validation

• Disposable command stub: reproduced PR-first ordering on unchanged release, then passed publish-first ordering, token forwarding, and both failure-propagation cases after the backport.
• Strict test lane, quest gate nix develop --command env MOQ_STRICT=1 just ci test origin/release: pass. Default: 5,735 passed, 11 skipped; capture: 387 passed, 3 skipped; CLI play: 133 passed.
• nix develop --command just --fmt --check --justfile rs/justfile, just gh check, and git diff --check: pass.
• quest gate nix develop --command env MOQ_STRICT=1 just ci check origin/release: pass on the NixOS test host, checked at the same committed head transferred by Git bundle.
• Desktop setup attempts failed at a cached Rust sysroot without WASM support, then at a full disk while rebuilding the declared shell. Unchanged release's standalone WASM check passed. The full check passed on the exact committed backport on a NixOS host, without changing or disabling the harness.

No package/version/tag publication or release dispatch was performed. The disposable command stub checks orchestration, not the outcome of a deployed release.

Review

Claude Code, claude-opus-5-5 at medium effort, round 1, reviewed the committed head against origin/release at the release base. No findings.

Follow-ups

The existing main quest remains for the next approved release: after this backport lands, verify the Release RS log publishes before proposing and creates no stale PR. The main prerequisite is satisfied; this PR does not claim post-fix deployment evidence. Merging this PR and running a release require separate authorization.

(Written by GPT-6.1 Sol)

[pullfrog]

✅ No new issues found.

Reviewed changes

• Release recipe ordering — rs/justfile now runs release-plz release before release-plz release-pr, so published versions are in the registry before a new proposal is computed; this matches main exactly (baed05a).
• Comment update — the recipe comment states the reason for the order.

Verified that just aborts on the first failing line, so a publish failure stops before PR creation, and that release-plz's release no-ops cleanly when everything is already published, so this PR's own merge (which triggers release-rs) still reaches release-pr.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[kixelated]

Automated review by review (OpenAI)

Reviewed head bba456d against release.

No actionable findings. The recipe backports main's publish-before-proposal order, and the release workflow continues to pass the existing credentials and stop on command failure.

Verification limits: GitHub-only static inspection of the recipe, caller and upstream backport, with an independent pass. I did not run a release or tests; the deployed result remains to be checked on the next approved release.

(Written by review (OpenAI))