reorder steps

.github/workflows/build_tag_publish.yml

@@ -9,18 +9,11 @@ on:
     paths-ignore: [ '**.md' ]
 
 jobs:
-  build-and-push-job:
+  secrets-check:
     runs-on: ubuntu-latest
-    permissions:
-      contents: 'write'
-      id-token: 'write'
-    outputs:
-      tag: ${{ steps.tag.outputs.tag }}
 
     steps:
       - uses: actions/checkout@v3
-        with:
-          token: ${{ secrets.BROADBOT_TOKEN }} # this allows the push to succeed later
 
       - name: Git secrets setup
         run: |
@@ -37,11 +30,19 @@ jobs:
           git secrets --scan-history
         shell: bash
 
-      - name: Setup JDK
-        uses: actions/setup-java@v4
+  build-and-push-job:
+    runs-on: ubuntu-latest
+    needs: [ secrets-check ]
+    permissions:
+      contents: 'write'
+      id-token: 'write'
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+
+    steps:
+      - uses: actions/checkout@v3
         with:
-          distribution: temurin
-          java-version: 11
+          token: ${{ secrets.BROADBOT_TOKEN }} # this allows the push to succeed later
 
       - name: Bump the tag to a new version
         uses: databiosphere/github-actions/actions/[email protected]
@@ -58,6 +59,12 @@ jobs:
           echo "DOCKERHUB_NAME=broadinstitute/agora:${{ steps.tag.outputs.tag }}" >> $GITHUB_OUTPUT
           echo "GCR_NAME=gcr.io/broad-dsp-gcr-public/agora:${{ steps.tag.outputs.tag }}" >> $GITHUB_OUTPUT
 
+      - name: Setup JDK
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: 11
+
       - name: Build image
         run: |
           docker build -t ${{ steps.image-name.outputs.DOCKERHUB_NAME }} .