chore: reorder release workflow jobs

.github/workflows/release.yml

@@ -161,75 +161,11 @@ jobs:
           name: release-assets
           path: dist/*
 
-  publish-crate:
-    name: Publish to crates.io
-    needs:
-      - meta
-      - release-assets
-    runs-on: ubuntu-latest
-    environment: release
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-          cache: "pnpm"
-          cache-dependency-path: pnpm-lock.yaml
-
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Cache cargo artifacts
-        uses: Swatinem/rust-cache@v2
-
-      - name: Authenticate with crates.io
-        uses: rust-lang/crates-io-auth-action@v1
-        id: crates-io-auth
-
-      - name: Publish workspace crates
-        shell: bash
-        env:
-          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
-        run: |
-          set -euo pipefail
-
-          # Publish in dependency order: earl-core first, then protocol
-          # crates, and finally the root earl crate.
-          CRATES=(
-            earl-core
-            earl-protocol-http
-            earl-protocol-grpc
-            earl-protocol-bash
-            earl-protocol-sql
-            earl
-          )
-
-          for crate in "${CRATES[@]}"; do
-            echo "Publishing $crate..."
-            cargo publish --locked -p "$crate"
-
-            # Wait for crates.io index to update before publishing
-            # dependents (skip delay after the last crate).
-            if [[ "$crate" != "earl" ]]; then
-              sleep 30
-            fi
-          done
-
   create-release:
     name: Publish GitHub Release
     needs:
       - meta
       - release-assets
-      - publish-crate
     runs-on: ubuntu-latest
     environment: release
     permissions:
@@ -265,7 +201,6 @@ jobs:
           gh workflow run release-notes.yml \
             --field tag="${{ needs.meta.outputs.tag }}"
 
-
   attest-provenance:
     name: Attest Build Provenance
     needs:
@@ -287,3 +222,66 @@ jobs:
         with:
           subject-path: |
             dist/*
+
+  publish-crate:
+    name: Publish to crates.io
+    needs:
+      - meta
+      - create-release
+    runs-on: ubuntu-latest
+    environment: release
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: "pnpm"
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache cargo artifacts
+        uses: Swatinem/rust-cache@v2
+
+      - name: Authenticate with crates.io
+        uses: rust-lang/crates-io-auth-action@v1
+        id: crates-io-auth
+
+      - name: Publish workspace crates
+        shell: bash
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.crates-io-auth.outputs.token }}
+        run: |
+          set -euo pipefail
+
+          # Publish in dependency order: earl-core first, then protocol
+          # crates, and finally the root earl crate.
+          CRATES=(
+            earl-core
+            earl-protocol-http
+            earl-protocol-grpc
+            earl-protocol-bash
+            earl-protocol-sql
+            earl
+          )
+
+          for crate in "${CRATES[@]}"; do
+            echo "Publishing $crate..."
+            cargo publish --locked -p "$crate"
+
+            # Wait for crates.io index to update before publishing
+            # dependents (skip delay after the last crate).
+            if [[ "$crate" != "earl" ]]; then
+              sleep 30
+            fi
+          done