Official Gradle Wrapper Validation GitHub Action

[JLLeitschuh]

See: https://github.com/gradle/wrapper-validation-action

CC: @mark-vieira

[mark-vieira]

Very interesting. So the existing validation in place is only for the distribution, right? There's currently nothing that actually validates the wrapper itself has not been tampered with?

[JLLeitschuh]

There is an implied assumption that you are trusting services.gradle.org is serving the correct json at https://services.gradle.org/versions/all

Assuming that the gradle-wrapper.jar you have checked into your repository matches at least one of the SHA-512 checksums we publish for all of our releases, this action will pass.

[JLLeitschuh]

Ohhhh. I understand. Correct, the checksum verification that you can commit to gradle-wrapper.properties does not verify the gradle-wrapper.jar hasn't been tampered with.

The goal of this action is to fill this gap.

[elasticmachine]

Pinging @elastic/es-core-infra (:Core/Infra/Build)

[JLLeitschuh]

Ping @mark-vieira

[rjernst]

@mark-vieira can you please review this?

[mark-vieira]

Sorry for the delay on this. Thanks for the submission @JLLeitschuh.