feature(ci, nightly-dispatcher): improve nightly dispatcher with yanked and unmaintained crates verification

.config/deny-full.toml

@@ -0,0 +1,3 @@
+[advisories]
+yanked = "deny"
+unmaintained = "all"

.github/workflows/nightly-dispatcher.yml

@@ -28,6 +28,16 @@ jobs:
     secrets:
       E2E_RUNNER_GCP_CREDENTIALS: ${{ secrets.E2E_RUNNER_GCP_CREDENTIALS }}
 
+  check-crates-advisories:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v6
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check advisories
+          arguments: "--all-features"
+          log-level: error
+
   publish-crate-dry-run-with-verification:
     runs-on: ubuntu-24.04
     steps:
@@ -72,6 +82,7 @@ jobs:
         test-client,
         test-rust,
         test-e2e,
+        check-crates-advisories,
         publish-crate-dry-run-with-verification,
         clippy-check-all-crates,
       ]

.github/workflows/test-notify-on-failure.yml

@@ -14,7 +14,7 @@ jobs:
       - name: Write HTML body to file
         run: |
           cat > ./email-body.html <<EOF
-          <h3>Nightly Trigger workflow has failed, see details:</h3>
+          <h3>${{ github.workflow }} workflow has failed, see details:</h3>
           <ul>
             <li><strong>Workflow :</strong> ${{ github.workflow }}</li>
             <li><strong>Repository :</strong> ${{ github.repository }}</li>
@@ -30,7 +30,7 @@ jobs:
           server_port: ${{ vars.CI_NOTIFICATION_SMTP_PORT }}
           username: ${{ secrets.CI_NOTIFICATION_SMTP_LOGIN }}
           password: ${{ secrets.CI_NOTIFICATION_SMTP_PASSWORD }}
-          subject: "🚨 Nightly Workflow Failed"
+          subject: "🚨 ${{ github.workflow }} Workflow Failed"
           to: ${{ secrets.CI_NOTIFICATION_EMAIL_TO }}
           from: ${{ secrets.CI_NOTIFICATION_EMAIL_FROM }}
           html_body: file://email-body.html

.github/workflows/weekly-dispatcher.yml

@@ -0,0 +1,50 @@
+name: Weekly Dispatcher
+
+on:
+  workflow_dispatch:
+  # Important note about scheduled workflows:
+  # Notifications for scheduled workflows are sent to the user who last modified the cron syntax in the workflow file.
+  schedule:
+    - cron: "0 1 * * 1"
+
+jobs:
+  check-crates-advisories-full:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Check advisories
+        uses: EmbarkStudios/cargo-deny-action@v2
+        id: deny
+        with:
+          command: check advisories
+          arguments: "--all-features --config .config/deny-full.toml"
+          log-level: error
+
+      - name: Explain result
+        if: always() && steps.deny.outcome != 'skipped'
+        run: |
+          {
+            echo "## Crates advisories (full check)"
+            echo ""
+            if [ "${{ steps.deny.outcome }}" = "failure" ]; then
+              echo "**Advisories found.**"
+              echo ""
+              echo "Yanked crates and vulnerabilities:"
+              echo "- Direct dependency of Mithril: open a fix PR with \`cargo update -p <package> [--precise <version>]\`."
+              echo "- Not a direct dependency: try \`cargo update -p <package>\` first; if a parent crate's version constraint blocks the update, add an ignore entry to \`deny.toml\` and wait for an upstream fix (this weekly check will keep reporting it)."
+              echo ""
+              echo "Unmaintained crates: if it is a direct dependency of Mithril, open an issue to replace it."
+            else
+              echo "No advisories found ✅"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  notify-on-failure:
+    uses: ./.github/workflows/test-notify-on-failure.yml
+    needs: [check-crates-advisories-full]
+    if: failure()
+    secrets: inherit

deny.toml

@@ -32,3 +32,13 @@ allow = [
     "Zlib",
 ]
 
+[advisories]
+yanked = "deny"
+unmaintained="none"
+ignore = [
+    # Known vulnerabilities
+    { id = "RUSTSEC-2026-0118", reason = "Known vulnerability on hickory-proto (0.25.2) not directly imported by Mithril crates" },
+    { id = "RUSTSEC-2026-0119", reason = "Known vulnerability on hickory-proto (0.25.2) not directly imported by Mithril crates" },
+]
+unused-ignored-advisory="deny"
+