https://docs.gradle.org/current/userguide/gradle_wrapper.html#wrapper_checksum_verification It seems there should be a way to add this as a github action to PRs and it's probably not an expensive check.