Currently, we recommend that users configure a separate workflow running the wrapper-validation-action to verify that the Gradle wrapper jar is not corrupted.

Doing this automatically for any workflow using setup-gradle and dependency-submission would increase coverage of wrapper validation and reduce the complexity for users adopting Gradle with GitHub actions. The functionality already exists with the validate-wrappers parameter: this issue is about enabling this by default.

Issues outstanding to allow this:

• Validate wrappers for all Gradle nightlies published at https://services.gradle.org/distributions-snapshots/ #281
• Cache checksums after they have been fetched #172