diff --git a/.github/workflows/static_checks.yml b/.github/workflows/static_checks.yml
index 6133780688a..af308e885a6 100644
--- a/.github/workflows/static_checks.yml
+++ b/.github/workflows/static_checks.yml
@@ -41,6 +41,11 @@ jobs:
           files=$(echo "$files" | grep -v 'thirdparty' | xargs -I {} sh -c 'echo "./{}"' | tr '\n' ' ')
           echo "CHANGED_FILES=$files" >> $GITHUB_ENV
 
+      # This needs to happen before Python and npm execution; it must happen before any extra files are written.
+      - name: .gitignore checks (gitignore_check.sh)
+        run: |
+          bash ./misc/scripts/gitignore_check.sh
+
       - name: File formatting checks (file_format.sh)
         run: |
           bash ./misc/scripts/file_format.sh changed.txt
diff --git a/misc/scripts/gitignore_check.sh b/misc/scripts/gitignore_check.sh
new file mode 100644
index 00000000000..f162e25391b
--- /dev/null
+++ b/misc/scripts/gitignore_check.sh
@@ -0,0 +1,26 @@
+set -uo pipefail
+shopt -s globstar
+
+echo -e ".gitignore validation..."
+
+# Get a list of files that exist in the repo but are ignored.
+
+# The --verbose flag also includes files un-ignored via ! prefixes.
+# We filter those out with a somewhat awkward `awk` directive.
+	# (Explanation: Split each line by : delimiters,
+	# see if the actual gitignore line shown in the third field starts with !,
+	# if it doesn't, print it.)
+
+# ignorecase for the sake of Windows users.
+
+output=$(git -c core.ignorecase=true check-ignore --verbose --no-index **/* | \
+    awk -F ':' '{ if ($3 !~ /^!/) print $0 }')
+
+# Then we take this result and return success if it's empty.
+if [ -z "$output" ]; then
+    exit 0
+else
+	# And print the result if it isn't.
+    echo "$output"
+    exit 1
+fi