Bundled pip and setuptools wheels have to be verified manually at the moment when they are upgraded.
We can automate this by comparing their checksums to ones provided by Warehouse’s JSON API (e.g., https://pypi.org/pypi/pip/json.)

Since such a check requires network activity and not to slow down tests, creating a GitHub Actions workflow that runs only when the files are changed is a good option.

I suggested this in https://github.com/python/cpython/pull/30178#issuecomment-998765841 originally.