Add opt-in upload-failure issue reporting to the action, and global watch for stale nightly

[Carreau]

AI GENERATED, NOT REVIEWED IN DEPTH, MOSTLY FOR DISCUSSION in #171

(This is based on an old commit as I was not on my computer, but I'll ask Claude to redo on main, but the principle is the same)

--
Adds two capabilities to the nightly upload workflow, plus lint CI:

1. Opt-in upload-failure reporting in the action itself: when an upload fails, open a tracking issue on the calling repository and close it automatically on the next success.
2. A channel-freshness monitor on this repo: a scheduled job that files issues when packages stop receiving nightly uploads, escalating from this coordination repo to the projects' own repos.

Both are implemented as small Python scripts run from GitHub Actions. No runtime dependency is added for consumers of the action.

1. Failure reporting (report_failures)

Extra composite steps wrap the existing pixi upload step:

jobs:
  upload:
    permissions:
      issues: write        # required by report_failures
      contents: read       # only if the job also checks out to build wheels
    steps:
      - uses: scientific-python/upload-nightly-action@<sha>
        with:
          artifacts_path: dist
          anaconda_nightly_upload_token: ${{ secrets.UPLOAD_TOKEN }}
          report_failures: true

• On failure: opens (or reuses) a nightly-upload-failure issue on the calling repo, then fails the job.
• On the next success: comments and closes it. Idempotent (found by label, not duplicated).
• Uses the built-in github.token by default (no new secret). Logic in scripts/report_failure.py, run via the action's pixi Python. It uses requests, which is already in the pixi lock (a dependency of anaconda-client), so consumers gain no new dependency.
• New inputs: report_failures, github_token (defaults to ${{ github.token }}), issue_repository.

2. Channel-freshness monitor (.github/workflows/monitor-nightly.yml)

A daily job queries the anaconda.org API for the scientific-python-nightly-wheels channel and files issues on this repo:

• > 30 days without an upload: open a stale-nightly issue per package.
• > 60 days: additionally open a nightly-purge-candidate issue.
• Both auto-close when a fresh upload lands.

It complements remove-wheels.yml (which prunes old versions); this only opens/closes issues and never deletes anything. It honors packages-ignore-from-cleanup.txt (so exempt packages such as openblas-libs are not flagged), guards on github.repository_owner == 'scientific-python', and uses a least-privilege built-in token.

Notifying the producing projects directly (opt-in)

If a Personal Access Token is provided as secrets.NIGHTLY_UPLOAD_ISSUE_PAT (the default GITHUB_TOKEN cannot write issues on other repos) and the wheel appears in the hand-maintained packages-source-repos.yaml mapping:

• > 15 days: open a nightly-upload-stalled issue on the wheel's own source repo, escalated with a comment at the 30- and 60-day marks, auto-closed on recovery.
• If the PAT is missing/expired/unauthorized, a nightly-pat-invalid issue is opened on this repo instead (using the built-in token) so maintainers rotate the secret; auto-closed once the token works again.

Fully opt-in: with no PAT or an empty mapping, this behaviour is skipped entirely.

packages-source-repos.yaml uses a packages: map where each entry is either wheel: owner/repo or wheel: {repo: owner/repo}, leaving room for per-repo config (labels, assignees, per-repo thresholds) later without a format change. It ships with an inert placeholder entry.

Logic lives in .github/scripts/monitor_nightly.py (PyGithub + requests + PyYAML, pinned in .github/scripts/requirements.txt).

3. Lint CI

.github/workflows/lint.yml runs ruff check and ruff format --check on scripts/ and .github/scripts/ on push/PR.

Configuration required (maintainers)

• No config needed for the 30/60-day coordination-repo behaviour.
• To enable producer-repo notifications: add the NIGHTLY_UPLOAD_ISSUE_PAT secret (a PAT with issues: write on the target repos) and populate packages-source-repos.yaml.
• Consumers who want failure reporting set report_failures: true and grant permissions: issues: write.

Notes

• Runs on the current pixi-based action (v0.6.4); the failure-reporting steps wrap the existing upload step without changing it.
• No untrusted input flows into run:/script: bodies. Package names reach only API calls; issue_repository/upload.outcome are passed via env: and read from os.environ/process.env. Actions are SHA-pinned (checkout v7.0.0, setup-python v6.3.0).
• Only GithubException from the PAT check is treated as "PAT broken"; transient/network errors are logged without filing a false alarm.

Testing

Local validation only (no live GitHub run yet):

• ruff check and ruff format --check pass; py_compile clean; all YAML parses.
• Monitor smoke-tested against the live anaconda.org API with stubbed GitHub: reads the ignore list, iterates all 35 packages, writes the freshness summary.
• Verified with fakes: producer open / 30-day escalate / 60-day escalate / recovery-close; invalid-PAT opens the self-repo issue and valid-PAT closes it; failure-report open-on-failure and close-on-success.

Note: the "Testing" section is local-only — the workflows haven't run end-to-end on GitHub yet (real issue creation, scheduled trigger, PAT auth). Trim that section if you don't want to imply live verification.