ci(gradle): pin Gradle distribution against published SHA-256

The Gradle wrapper had no distributionSha256Sum, so the Gradle 9.6.0 distribution was the one unpinned download in CI (validateDistributionUrl only checks the URL shape, not content). Pin it to Gradle's published SHA-256 so the wrapper fails closed on any corrupt/tampered distribution, matching the SHA-256 integrity pin cmdline-tools already gets (#389).
2026-07-08 12:05:00 -05:00
parent 487c3b36a5
commit 7a0cc3145c
1 changed files with 1 additions and 0 deletions
@@ -1,6 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
+distributionSha256Sum=bbaeb2fef8710818cf0e261201dab964c572f92b942812df0c3620d62a529a01
 networkTimeout=10000
 retries=0
 retryBackOffMs=500