ci: checkout repo first

I actually changed that thinking it'd be a good idea, but it's actually
quite a stupid idea and broke things

Author: cyyynthia

.github/workflows/build.yaml

@@ -16,13 +16,13 @@ jobs:
   build:
     runs-on: ubuntu-slim
     steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with: { persist-credentials: false }
+
       - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
       - uses: pnpm/setup@5d160c5bc68a09337ad0d5654e237e03253b5879 # v1
         with: { cache: true }
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-        with: { persist-credentials: false }
-
       - run: just build
 
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -37,12 +37,12 @@ jobs:
         node: [18, 20, 22, 24, 26]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: pnpm/setup@5d160c5bc68a09337ad0d5654e237e03253b5879 # v1
-        with: { cache: true, runtime: "node@${{ matrix.node }}" }
-
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with: { persist-credentials: false }
 
+      - uses: pnpm/setup@5d160c5bc68a09337ad0d5654e237e03253b5879 # v1
+        with: { cache: true, runtime: "node@${{ matrix.node }}" }
+
       - run: pnpm run test
 
   toml-test:

.github/workflows/publish.yaml

@@ -18,9 +18,9 @@ jobs:
       id-token: write # Required for provenance and Trusted Publishing
       contents: read
     steps:
-      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
-      - uses: pnpm/setup@5d160c5bc68a09337ad0d5654e237e03253b5879 # v1
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with: { persist-credentials: false }
 
+      - uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+      - uses: pnpm/setup@5d160c5bc68a09337ad0d5654e237e03253b5879 # v1
       - run: just publish