workflows: nightly: add

Provide a nightly CI workflow for checking:

1. Latest upstream package versions versus those available in the RISE
   registry
2. Packages which have upstream riscv64 wheels (ready for deprecation in
   our CI)
3. Check that packages install correctly in a riscv64 container
4. Run pip-audit to scan for vulnerabilities

This is based on the following jobs from wheel_builder's .gitlab-ci.yml
script:

- check_deprecated_packages
- check_installation
- check_versions
- pip_audit

One notable difference is that we use RISE's RISC-V Runners for the
steps which would otherwise run the setup-qemu action.

AI-Generated: Uses Claude Code Sonnet 4.7

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>

Author: threexc

.github/workflows/nightly.yml

@@ -0,0 +1,101 @@
+# SPDX-FileCopyrightText: 2026 The RISE Project
+# SPDX-License-Identifier: MIT
+
+name: Run nightly package version and status checks
+
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+  issues: read
+
+env:
+  PIP_EXTRA_INDEX_URL: https://gitlab.com/api/v4/projects/56254198/packages/pypi/simple
+
+jobs:
+  check_versions:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3'
+
+      - name: Install Python dependencies
+        run: pip install requests packaging
+
+      - name: Check versions and open PRs
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 ci_scripts/check_versions.py --summary --create-prs
+
+  check_deprecated_packages:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install curl and jq
+        run: sudo apt-get update -qq && sudo apt-get install -qq -y curl jq
+
+      - name: Verify riscv64 wheels still published
+        run: |
+          ret=0
+          while IFS= read -r pkg; do
+            [[ -z "$pkg" || "$pkg" =~ ^[[:space:]]*# ]] && continue
+
+            if ! output=$(curl -sf "https://pypi.org/pypi/${pkg}/json"); then
+              echo "Failed to fetch $pkg, skipping..."
+              continue
+            fi
+
+            if ! filenames=$(echo "$output" | jq -r '.urls[].filename'); then
+              echo "Failed to parse JSON for $pkg, skipping..."
+              continue
+            fi
+
+            if ! echo "$filenames" | grep -qi riscv; then
+              echo "$pkg does not distribute riscv64 wheel anymore!"
+              ret=1
+            fi
+          done < ci_scripts/deprecated.txt
+          exit $ret
+
+  check_installation:
+    runs-on: ubuntu-24.04-riscv
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install packages inside riscv64 container
+        working-directory: ci_scripts
+        run: |
+          sed -Ei 's/^scipy.*$//' packages.txt
+          sed -Ei 's/^patchelf.*$//' packages.txt
+          docker run --platform=linux/riscv64 -w /root --rm \
+            -e PIP_PREFER_BINARY=1 \
+            -e PIP_EXTRA_INDEX_URL \
+            -v "$PWD":/root \
+            riscv64/ubuntu:24.04 ./list-packages.sh wb
+
+  pip_audit:
+    runs-on: ubuntu-24.04-riscv
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run pip-audit inside riscv64 container
+        working-directory: ci_scripts
+        run: |
+          docker run --platform=linux/riscv64 -w /root --rm \
+            -e PIP_PREFER_BINARY=1 \
+            -e PIP_EXTRA_INDEX_URL \
+            -v "$PWD":/root \
+            riscv64/ubuntu:24.04 ./audit.sh wb