diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 528c22d..31ca94e 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -31,30 +31,23 @@ jobs:
       - name: Checkout (from event.json, no external actions)
         run: |
           set -euo pipefail
-
           EVENT_JSON="/var/run/act/workflow/event.json"
           test -f "$EVENT_JSON" || (echo "❌ Missing $EVENT_JSON" && exit 1)
 
-          # Extract repo clone url + sha from event payload (push or pull_request)
           eval "$(node - <<'NODE'
           import fs from "node:fs";
           const ev = JSON.parse(fs.readFileSync("/var/run/act/workflow/event.json","utf8"));
-
           const repo =
             ev?.repository?.clone_url ||
             (ev?.repository?.html_url ? (ev.repository.html_url.replace(/\/$/,'') + ".git") : "");
-
           const sha =
             ev?.after ||
             ev?.pull_request?.head?.sha ||
             ev?.head_commit?.id ||
             ev?.sha ||
             "";
-
           if (!repo) { console.error("No repository.clone_url/html_url in event.json"); process.exit(1); }
           if (!sha)  { console.error("No sha/after/pull_request.head.sha in event.json"); process.exit(1); }
-
-          // print shell-safe assignments
           console.log(`REPO_URL=${JSON.stringify(repo)}`);
           console.log(`SHA=${JSON.stringify(sha)}`);
 NODE
@@ -70,6 +63,11 @@ NODE
           git checkout -q FETCH_HEAD
           git log -1 --oneline
 
+      - name: Anchor aliases schema
+        run: |
+          set -euo pipefail
+          node scripts/check-anchor-aliases.mjs
+
       - name: NPM harden
         run: |
           set -euo pipefail
@@ -99,11 +97,6 @@ NODE
           set -euo pipefail
           npm run test:anchors
 
-      - name: Anchor aliases schema
-        run: |
-          set -euo pipefail
-          node scripts/check-anchor-aliases.mjs
-
       - name: Verify anchor aliases injected in dist
         run: |
           set -euo pipefail