workflows: nightly: add

Provide a nightly CI workflow for checking:

1. Latest upstream package versions versus those available in the RISE
   registry
2. Packages which have upstream riscv64 wheels (ready for deprecation in
   our CI)
3. Check that packages install correctly in a riscv64 container
4. Run pip-audit to scan for vulnerabilities

This is based on the following jobs from wheel_builder's .gitlab-ci.yml
script:

- check_deprecated_packages
- check_installation
- check_versions
- pip_audit

Two notable differences compared to the original logic (in addition to
the GitLab CI -> GHA rework):

1. We use RISE's RISC-V Runners for the steps which would otherwise run
   the setup-qemu action.
2. A step is added using the new audit_report.py script to file issues
   when vulnerabilities are detected.

AI-Generated: Uses Claude Code Opus 4.7

Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com>

Author: threexc

.github/workflows/nightly.yml

@@ -0,0 +1,99 @@
+# SPDX-FileCopyrightText: 2026 The RISE Project
+# SPDX-License-Identifier: MIT
+
+name: Run nightly package version and status checks
+
+on:
+  schedule:
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+  issues: read
+
+env:
+  PIP_EXTRA_INDEX_URL: https://gitlab.com/api/v4/projects/56254198/packages/pypi/simple
+
+jobs:
+  check_versions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3'
+
+      - name: Install Python dependencies
+        run: pip install requests packaging
+
+      - name: Check versions and open PRs
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 ci_scripts/check_versions.py --summary --create-prs
+
+  check_deprecated_packages:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install curl and jq
+        run: sudo apt-get update -qq && sudo apt-get install -qq -y curl jq
+
+      - name: Verify riscv64 wheels still published
+        run: |
+          ret=0
+          while IFS= read -r pkg; do
+            [[ -z "$pkg" || "$pkg" =~ ^[[:space:]]*# ]] && continue
+
+            if ! output=$(curl -sf "https://pypi.org/pypi/${pkg}/json"); then
+              echo "Failed to fetch $pkg, skipping..."
+              continue
+            fi
+
+            if ! filenames=$(echo "$output" | jq -r '.urls[].filename'); then
+              echo "Failed to parse JSON for $pkg, skipping..."
+              continue
+            fi
+
+            if ! echo "$filenames" | grep -qi riscv; then
+              echo "$pkg does not distribute riscv64 wheel anymore!"
+              ret=1
+            fi
+          done < ci_scripts/deprecated.txt
+          exit $ret
+
+  check_installation:
+    runs-on: ubuntu-24.04-riscv
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install packages inside riscv64 container
+        working-directory: ci_scripts
+        run: |
+          sed -Ei 's/^scipy.*$//' packages.txt
+          sed -Ei 's/^patchelf.*$//' packages.txt
+          ./list-packages.sh python-wheels
+
+  pip_audit:
+    runs-on: ubuntu-24.04-riscv
+    continue-on-error: true
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run pip-audit
+        working-directory: ci_scripts
+        run: ./audit.sh python-wheels
+
+      - name: Report vulnerabilities and open issues
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 ci_scripts/audit_report.py ci_scripts/audit-report.json