diff --git a/go.mod b/go.mod
index 2e815645548..8819ba15d85 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,13 @@ module github.com/ossf/scorecard/v4
 
 go 1.17
 
+// TODO(go.mod): Is there a reason these deps are kept separately from the
+//               other `require`s?
+require (
+	github.com/rhysd/actionlint v1.6.8
+	gotest.tools v2.2.0+incompatible
+)
+
 require (
 	cloud.google.com/go/bigquery v1.27.0
 	cloud.google.com/go/monitoring v0.1.0 // indirect
@@ -37,13 +44,6 @@ require (
 	mvdan.cc/sh/v3 v3.4.2
 )
 
-// TODO(go.mod): Is there a reason these deps are kept separately from the
-//               other `require`s?
-require (
-	github.com/rhysd/actionlint v1.6.8
-	gotest.tools v2.2.0+incompatible
-)
-
 require (
 	cloud.google.com/go v0.100.2 // indirect
 	cloud.google.com/go/compute v0.1.0 // indirect