From 485910f5af41d0e5b569af1cafb6fa97510c8a0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20Turmel?= <turmel@teragone-solutions.com>
Date: Thu, 8 Oct 2026 17:15:43 +0200
Subject: [PATCH 1/2] feature(ci, nightly-dispatcher): improve nightly
 dispatcher with yanked and unmaintained crates verification

---
 .github/workflows/nightly-dispatcher.yml | 11 +++++++++++
 deny.toml                                | 10 ++++++++++
 2 files changed, 21 insertions(+)

diff --git a/.github/workflows/nightly-dispatcher.yml b/.github/workflows/nightly-dispatcher.yml
index 82836012b20..9466d84e5e9 100644
--- a/.github/workflows/nightly-dispatcher.yml
+++ b/.github/workflows/nightly-dispatcher.yml
@@ -28,6 +28,16 @@ jobs:
     secrets:
       E2E_RUNNER_GCP_CREDENTIALS: ${{ secrets.E2E_RUNNER_GCP_CREDENTIALS }}
 
+  check-crates-advisories:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories
+          arguments: "--all-features"
+          log-level: error
+
   publish-crate-dry-run-with-verification:
     runs-on: ubuntu-24.04
     steps:
@@ -72,6 +82,7 @@ jobs:
         test-client,
         test-rust,
         test-e2e,
+        check-crates-advisories,
         publish-crate-dry-run-with-verification,
         clippy-check-all-crates,
       ]
diff --git a/deny.toml b/deny.toml
index ca955199776..f0d99bd5372 100644
--- a/deny.toml
+++ b/deny.toml
@@ -32,3 +32,13 @@ allow = [
     "Zlib",
 ]
 
+[advisories]
+yanked = "deny"
+unmaintained="none"
+ignore = [
+    # Known vulnerabilities
+    { id = "RUSTSEC-2026-0118", reason = "Known vulnerability on hickory-proto (0.25.2) not directly imported by Mithril crates" },
+    { id = "RUSTSEC-2026-0119", reason = "Known vulnerability on hickory-proto (0.25.2) not directly imported by Mithril crates" },
+]
+unused-ignored-advisory="deny"
+

From e75fbdd908b88af5e5221d4c9ee45b537b294ed6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20Turmel?= <turmel@teragone-solutions.com>
Date: Fri, 9 Oct 2026 15:07:18 +0200
Subject: [PATCH 2/2] feature(ci): introduce a weekly job that checks all
 advisories (yanked, unmaintained, vulnerabilities)

---
 .config/deny-full.toml                       |  3 ++
 .github/workflows/test-notify-on-failure.yml |  4 +-
 .github/workflows/weekly-dispatcher.yml      | 50 ++++++++++++++++++++
 3 files changed, 55 insertions(+), 2 deletions(-)
 create mode 100644 .config/deny-full.toml
 create mode 100644 .github/workflows/weekly-dispatcher.yml

diff --git a/.config/deny-full.toml b/.config/deny-full.toml
new file mode 100644
index 00000000000..9c5a71327a7
--- /dev/null
+++ b/.config/deny-full.toml
@@ -0,0 +1,3 @@
+[advisories]
+yanked = "deny"
+unmaintained = "all"
diff --git a/.github/workflows/test-notify-on-failure.yml b/.github/workflows/test-notify-on-failure.yml
index 4762f5eaa88..81c9656c191 100644
--- a/.github/workflows/test-notify-on-failure.yml
+++ b/.github/workflows/test-notify-on-failure.yml
@@ -14,7 +14,7 @@ jobs:
       - name: Write HTML body to file
         run: |
           cat > ./email-body.html <<EOF
-          <h3>Nightly Trigger workflow has failed, see details:</h3>
+          <h3>${{ github.workflow }} workflow has failed, see details:</h3>
           <ul>
             <li><strong>Workflow :</strong> ${{ github.workflow }}</li>
             <li><strong>Repository :</strong> ${{ github.repository }}</li>
@@ -30,7 +30,7 @@ jobs:
           server_port: ${{ vars.CI_NOTIFICATION_SMTP_PORT }}
           username: ${{ secrets.CI_NOTIFICATION_SMTP_LOGIN }}
           password: ${{ secrets.CI_NOTIFICATION_SMTP_PASSWORD }}
-          subject: "🚨 Nightly Workflow Failed"
+          subject: "🚨 ${{ github.workflow }} Workflow Failed"
           to: ${{ secrets.CI_NOTIFICATION_EMAIL_TO }}
           from: ${{ secrets.CI_NOTIFICATION_EMAIL_FROM }}
           html_body: file://email-body.html
diff --git a/.github/workflows/weekly-dispatcher.yml b/.github/workflows/weekly-dispatcher.yml
new file mode 100644
index 00000000000..70702873bf4
--- /dev/null
+++ b/.github/workflows/weekly-dispatcher.yml
@@ -0,0 +1,50 @@
+name: Weekly Dispatcher
+
+on:
+  workflow_dispatch:
+  # Important note about scheduled workflows:
+  # Notifications for scheduled workflows are sent to the user who last modified the cron syntax in the workflow file.
+  schedule:
+    - cron: "0 1 * * 1"
+
+jobs:
+  check-crates-advisories-full:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Check advisories
+        uses: EmbarkStudios/cargo-deny-action@v2
+        id: deny
+        with:
+          command: check advisories
+          arguments: "--all-features --config .config/deny-full.toml"
+          log-level: error
+
+      - name: Explain result
+        if: always() && steps.deny.outcome != 'skipped'
+        run: |
+          {
+            echo "## Crates advisories (full check)"
+            echo ""
+            if [ "${{ steps.deny.outcome }}" = "failure" ]; then
+              echo "**Advisories found.**"
+              echo ""
+              echo "Yanked crates and vulnerabilities:"
+              echo "- Direct dependency of Mithril: open a fix PR with \`cargo update -p <package> [--precise <version>]\`."
+              echo "- Not a direct dependency: try \`cargo update -p <package>\` first; if a parent crate's version constraint blocks the update, add an ignore entry to \`deny.toml\` and wait for an upstream fix (this weekly check will keep reporting it)."
+              echo ""
+              echo "Unmaintained crates: if it is a direct dependency of Mithril, open an issue to replace it."
+            else
+              echo "No advisories found ✅"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  notify-on-failure:
+    uses: ./.github/workflows/test-notify-on-failure.yml
+    needs: [check-crates-advisories-full]
+    if: failure()
+    secrets: inherit