Move gradle wrapper-validation to top-level workflow to make OSSF scorecord happy

.github/workflows/build-common.yml

@@ -47,13 +47,6 @@ jobs:
       - name: Spotless
         run: ./gradlew spotlessCheck ${{ inputs.no-build-cache && '--no-build-cache' || '' }}
 
-  gradle-wrapper-validation:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2
-
   license-check:
     runs-on: ubuntu-latest
     steps:

.github/workflows/build-pull-request.yml

@@ -16,6 +16,14 @@ permissions:
   contents: read
 
 jobs:
+  gradle-wrapper-validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # this needs to be in the top-level workflow in order to make OSSF scorecard happy
+      - uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2
+
   common:
     uses: ./.github/workflows/build-common.yml
     with:
@@ -71,6 +79,7 @@ jobs:
     # only the "common" checks are required for release branch PRs in order to avoid any unnecessary
     # release branch maintenance (especially for patches)
     needs:
+      - gradle-wrapper-validation
       - common
       - muzzle
       - shell-script-check

.github/workflows/build.yml

@@ -11,6 +11,14 @@ permissions:
   contents: read
 
 jobs:
+  gradle-wrapper-validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # this needs to be in the top-level workflow in order to make OSSF scorecard happy
+      - uses: gradle/actions/wrapper-validation@0bdd871935719febd78681f197cd39af5b6e16a6 # v4.2.2
+
   common:
     uses: ./.github/workflows/build-common.yml