When the project is checked out, is there a comparison made between the SHA of the checkout and the SHA that was sent by the webhook payload? And if so, is there a way to skip this validation?