# Verifying Gradle Wrappers with GitHub Actions

DevFeed: [Verifying Gradle Wrappers with GitHub Actions](<https://devfeed.tech/articles/verifying-gradle-wrappers-with-github-actions-24636.md>)

Original publisher: [Read original article](<https://blog.gradle.org/gradle-wrapper-checksum-verification-github-action>)

Author: Jonathan Leitschuh

Published: 2020-02-06T05:00:00Z

Content type: article

Language: en

Sources: [The Gradle Blog](<https://devfeed.tech/sources/the-gradle-blog.md>)

Topics: [Gradle](<https://devfeed.tech/topics/gradle.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [pull-requests](<https://devfeed.tech/topics/pull-requests.md>)

Tags: [github-actions](<https://devfeed.tech/tags/github-actions.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [security](<https://devfeed.tech/tags/security.md>), [validation](<https://devfeed.tech/tags/validation.md>)

## AI overview

The article introduces a Gradle Wrapper Validation GitHub Action that checks Gradle Wrapper files against official SHA-256 checksums and detects homoglyph variants. It explains how malicious changes to the executable Gradle Wrapper can enable arbitrary code execution and recommends using the action to protect open-source repositories.

## Source excerpt

ℹ Update on June 26, 2025 The link for the wrapper validation GitHub action has been fixed. We are proud to announce the release of the new Gradle Wrapper Validation GitHub Action. Gradle Wrapper in Open Source The gradle-wrapper.jar is a binary blob of executable code that is checked into nearly 2.8 Million GitHub Repositories. Searching across GitHub you can find many pull requests (PRs) with helpful titles like 'Update to Gradle xxx'. Many of these PRs are contributed by individuals outside of the organization maintaining the project. Maintainers are grateful for these kinds of contributions as it takes an item off of their backlog. But there are security implications of accepting changes to the Gradle Wrapper binary from external contributors that may not be apparent. An attacker could take advantage of the trust the open source community has by hiding malicious code inside the Gradle Wrapper. A malicious gradle-wrapper.jar could download, install and execute arbitrary code while otherwise behaving like a completely normal gradle-wrapper.jar. Such an attack could be easily missed as the diff to the gradle-wrapper.jar looks like this. Verifying the Gradle Wrapper We have created a simple GitHub Action that can be applied to any GitHub repository. This action will verify that any and all gradle-wrapper.jar files in the repository match an official SHA-256 checksum. If any file does not match, the action will fail. Additionally, the action will detect any homoglyph variants of a file named gradle-wrapper.jar. The goal is to prevent difficult to spot homoglyph attacks, like renaming the gradle-wrapper.jar file to gradlе-wrapper.jar (which uses a Cyrillic е instead of e). Securing Your Project GitHub actions are free to use for open-source and are automatically enabled by default on almost all repositories. You can find out more about how to add this action to your GitHub repository here. Existing Users This action has already been contributed to some of the most po