diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 452301c..5085408 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -11,3 +11,16 @@ updates:
           - "*"
     labels:
       - "github-actions"
+      - "chore"
+
+  # Maintain the pinned dependencies of the Python tools
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      python:
+        patterns:
+          - "*"
+    labels:
+      - "chore"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e4e739b..c676099 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,10 +15,32 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  test-stale-wheels:
+    name: "test stale wheel check"
+    # No secrets needed, so this one can also run on forks
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        with:
+          python-version: '3.14'
+
+      - name: Run the tests
+        run: uv run --with-requirements requirements.txt tests/test_check_stale_wheels.py
+
   test:
     name: "test upload via action"
     runs-on: ubuntu-latest
     if: github.repository == 'scientific-python/upload-nightly-action'
+    # Pull requests from forks and from Dependabot are not given secrets, so there
+    # they check that the action refuses to run rather than really uploading
+    env:
+      HAS_TOKEN: ${{ secrets.UPLOAD_TOKEN != '' }}
+    outputs:
+      uploaded: ${{ steps.record.outputs.uploaded }}
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
@@ -47,19 +69,41 @@ jobs:
       - name: List contents of wheel
         run: python -m zipfile --list dist/test_package-*.whl
 
+      - name: Test that an upload without a token is refused
+        id: no_token
+        if: env.HAS_TOKEN != 'true'
+        continue-on-error: true
+        uses: ./_action_path/
+        with:
+          artifacts_path: dist
+          anaconda_nightly_upload_token: ''
+
+      - name: Check that the upload was refused
+        if: env.HAS_TOKEN != 'true'
+        env:
+          OUTCOME: ${{ steps.no_token.outcome }}
+        run: |
+          if [ "${OUTCOME}" != "failure" ]; then
+              echo "::error::the action did not refuse to upload without a token"
+              exit 1
+          fi
+
       - name: Test upload
+        if: env.HAS_TOKEN == 'true'
         uses: ./_action_path/
         with:
           artifacts_path: dist
           anaconda_nightly_upload_token: ${{ secrets.UPLOAD_TOKEN }}
 
       - name: Test upload that forces removal first
+        if: env.HAS_TOKEN == 'true'
         uses: ./_action_path/
         with:
           artifacts_path: dist
           anaconda_nightly_upload_token: ${{ secrets.UPLOAD_TOKEN }}
 
       - name: Build v0.0.2 wheel and sdist
+        if: env.HAS_TOKEN == 'true'
         run: |
           # Bump version to avoid wheel name conflicts
           sed -i 's/0.0.1/0.0.2/g' _action_path/tests/test_package/pyproject.toml
@@ -67,6 +111,7 @@ jobs:
           uv tool run --from build pyproject-build --installer=uv --outdir ./dist _action_path/tests/test_package
 
       - name: Test upload with non-main label
+        if: env.HAS_TOKEN == 'true'
         uses: ./_action_path/
         with:
           artifacts_path: dist
@@ -74,6 +119,7 @@ jobs:
           anaconda_nightly_upload_labels: test
 
       - name: Build v0.0.3 wheel and sdist
+        if: env.HAS_TOKEN == 'true'
         run: |
           # Bump version to avoid wheel name conflicts
           sed -i 's/0.0.2/0.0.3/g' _action_path/tests/test_package/pyproject.toml
@@ -81,15 +127,22 @@ jobs:
           uv tool run --from build pyproject-build --installer=uv --outdir ./dist _action_path/tests/test_package
 
       - name: Test upload with multiple labels
+        if: env.HAS_TOKEN == 'true'
         uses: ./_action_path/
         with:
           artifacts_path: dist
           anaconda_nightly_upload_token: ${{ secrets.UPLOAD_TOKEN }}
           anaconda_nightly_upload_labels: dev,test
 
+      - name: Record whether anything was uploaded
+        id: record
+        run: echo "uploaded=${HAS_TOKEN}" | tee -a "${GITHUB_OUTPUT}"
+
   cleanup:
     runs-on: ubuntu-latest
     needs: [test]
+    # Nothing to clean up when the uploads were skipped for lack of a token
+    if: needs.test.outputs.uploaded == 'true'
     # Set required workflow secrets in the environment for additional security
     # https://github.com/scientific-python/upload-nightly-action/settings/environments
     environment:
@@ -107,3 +160,12 @@ jobs:
             anaconda --token ${{ secrets.ANACONDA_TOKEN }} remove \
               --force \
               "scientific-python-nightly-wheels/test-package"
+
+  report-failure:
+    needs: [test-stale-wheels, test, cleanup]
+    if: failure() && github.event_name == 'schedule'
+    permissions:
+      issues: write
+    uses: ./.github/workflows/report-failure.yml
+    with:
+      title: 'The scheduled CI run is failing'
diff --git a/.github/workflows/keep-alive.yml b/.github/workflows/keep-alive.yml
index 9704f6e..e30d7e6 100644
--- a/.github/workflows/keep-alive.yml
+++ b/.github/workflows/keep-alive.yml
@@ -36,3 +36,12 @@ jobs:
         user_name: 'github-actions[bot]'
         user_email: 'github-actions[bot]@users.noreply.github.com'
         commit_message: Keep repo GitHub Actions alive
+
+  report-failure:
+    needs: [deploy]
+    if: failure() && github.event_name == 'schedule'
+    permissions:
+      issues: write
+    uses: ./.github/workflows/report-failure.yml
+    with:
+      title: 'The workflow keep-alive is failing'
diff --git a/.github/workflows/remove-wheels.yml b/.github/workflows/remove-wheels.yml
index 00af0f7..be6fb6f 100644
--- a/.github/workflows/remove-wheels.yml
+++ b/.github/workflows/remove-wheels.yml
@@ -109,3 +109,12 @@ jobs:
 
               done
           fi
+
+  report-failure:
+    needs: [remove]
+    if: failure() && github.event_name == 'schedule'
+    permissions:
+      issues: write
+    uses: ./.github/workflows/report-failure.yml
+    with:
+      title: 'The old wheel cleanup is failing'
diff --git a/.github/workflows/report-failure.yml b/.github/workflows/report-failure.yml
new file mode 100644
index 0000000..a977e24
--- /dev/null
+++ b/.github/workflows/report-failure.yml
@@ -0,0 +1,46 @@
+name: Report a failing workflow
+
+# Called by the scheduled workflows in this repository when they fail. A cron job
+# that quietly stops working can go unnoticed for months, which is the very thing
+# this repository nags other projects about.
+
+on:
+  workflow_call:
+    inputs:
+      title:
+        description: 'Title of the issue to open, and to reuse while it stays open'
+        required: true
+        type: string
+
+jobs:
+  report:
+
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+
+    steps:
+      - name: Open or update an issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TITLE: ${{ inputs.title }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          body="\`${GITHUB_WORKFLOW}\` failed, most recently in [this run](${RUN_URL}).
+
+          Until it is fixed, whatever that workflow keeps an eye on is unattended."
+
+          # Only ever match our own issues, so the default page of 30 cannot hide the
+          # one we are looking for. Without --search this is the REST creator filter,
+          # which wants the literal login: "app/github-actions" matches nothing here.
+          number=$(gh issue list --repo "${GITHUB_REPOSITORY}" --state open \
+              --author "github-actions[bot]" --json number,title \
+              --jq 'map(select(.title == env.TITLE)) | .[0].number // ""')
+
+          # Rewrite rather than comment, so a workflow that fails every day does not
+          # collect a comment a day
+          if [ -n "${number}" ]; then
+              gh issue edit "${number}" --repo "${GITHUB_REPOSITORY}" --body "${body}"
+          else
+              gh issue create --repo "${GITHUB_REPOSITORY}" --title "${TITLE}" --body "${body}"
+          fi
diff --git a/.github/workflows/stale-wheels.yml b/.github/workflows/stale-wheels.yml
new file mode 100644
index 0000000..4e6bfa4
--- /dev/null
+++ b/.github/workflows/stale-wheels.yml
@@ -0,0 +1,49 @@
+name: Report stale wheels
+
+on:
+  # Run daily at 0:23 UTC, an hour before "Remove old wheels"
+  schedule:
+  - cron:  '23 0 * * *'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Report findings without opening or closing any issues'
+        type: boolean
+        default: true
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  report:
+
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'scientific-python'
+    # Needed to open an issue here if we cannot reach a project's own tracker
+    permissions:
+      issues: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Install the latest version of uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
+        with:
+          python-version: '3.14'
+
+      - name: Check for stale wheels
+        env:
+          ISSUE_OPENER_TOKEN: ${{ secrets.ISSUE_OPENER_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          uv run --with-requirements requirements.txt tools/check_stale_wheels.py ${{ inputs.dry_run && '--dry-run' || '' }}
+
+  report-failure:
+    needs: [report]
+    if: failure() && github.event_name == 'schedule'
+    permissions:
+      issues: write
+    uses: ./.github/workflows/report-failure.yml
+    with:
+      title: 'The stale nightly wheel check is failing'
diff --git a/.gitignore b/.gitignore
index 096b5eb..3cf3cb8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
 # pixi environments
 .pixi
 *.egg-info
+__pycache__
+.pytest_cache
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..ffb298c
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,61 @@
+# Notes for agents
+
+Guidance for automated contributors working in this repository.
+Written for someone who can read the code but has no way to know the conventions or the reasoning behind them.
+
+## What is here
+
+`action.yml` and `upload_wheels.sh` are the published action itself, which projects call from their own workflows to upload nightly wheels.
+Everything else exists to look after the [`scientific-python-nightly-wheels`](https://anaconda.org/scientific-python-nightly-wheels) channel those uploads land on.
+
+`.github/workflows/remove-wheels.yml` deletes wheels beyond the retention policy, daily at 01:23 UTC.
+`tools/check_stale_wheels.py` warns projects before that deletion strands them, daily at 00:23 UTC.
+The hour between the two is deliberate: a package must be flagged before it can be deleted, and a fully deleted package disappears from the channel listing where we would no longer see it at all.
+
+`.github/workflows/report-failure.yml` is a reusable workflow every scheduled workflow calls when it fails.
+This repository nags other projects about silently broken automation, so its own cron jobs must not fail quietly.
+It is called as a job rather than used as a composite action because `ci.yml` checks out to `_action_path` and `remove-wheels.yml` does not check out at all.
+
+## Conventions
+
+Pin third-party actions to a full commit SHA with a `# vX.Y.Z` comment; Dependabot updates them monthly as a single group.
+
+Run the Python tools with `uv run --with-requirements requirements.txt <script>`, which is how the workflows invoke them; the scripts carry no PEP 723 header, so that their dependencies are declared in exactly one place.
+That file pins exact versions rather than a `uv.lock`, because Dependabot has no `uv` ecosystem and an unmaintainable lock would only rot, while it does understand `requirements.txt` and proposes updates monthly.
+`scientific-python/issue-from-pytest-log-action` is worth reading for the rest of the house style, though it locks its scripts individually where this repository does not.
+
+Pin versions exactly, as `pixi.toml` and `requirements.txt` both do.
+Do not add a `[tool.uv] exclude-newer` window to a script whose dependencies Dependabot pins: uv then refuses to resolve any pin newer than the cutoff, leaving every Dependabot pull request unresolvable until the release ages past it.
+The window in `pixi.toml` is fine, because those versions are bumped by hand.
+
+Format Python with `ruff format --line-length 100`; there is no ruff configuration in the repository yet, so pass the length explicitly.
+
+## Things that will catch you out
+
+Pull requests from forks *and* from Dependabot receive no secrets, so a job keyed on `github.event.pull_request.head.repo.fork` still breaks for Dependabot.
+Gate on the secret instead, as `ci.yml` does with `HAS_TOKEN: ${{ secrets.UPLOAD_TOKEN != '' }}`, and have the tokenless path assert the action refuses to upload.
+
+A called workflow's token is capped by the calling job's, so a job that calls `report-failure.yml` must itself declare `permissions: issues: write`.
+
+The anaconda.org API's `latest_version` is not the most recently uploaded version, because nightly version strings do not sort consistently across projects.
+Take the maximum `upload_time` across every version instead.
+
+That API carries no repository URL for these packages — `home`, `dev_url`, and `source_git_url` are all null — so `check_stale_wheels.py` resolves the target repository from PyPI `Project-URL` metadata, with `PYPI_MAP` covering the one package that has none.
+
+PyGithub serializes every request through an internal connection lock, so threading does not speed up the GitHub half of a run.
+A full stale wheel check takes about two minutes, which is fine for a daily job.
+
+## Working on the stale wheel check
+
+Run it with `ISSUE_OPENER_TOKEN` and `GITHUB_TOKEN` set, and keep `--dry-run` on unless you intend to open issues in other projects' trackers.
+Dry runs still authenticate and still read issues; they only skip writes.
+
+The thresholds are constants at the top of the script rather than command line options, by request: add an option only when something actually needs to vary.
+`RETENTION_DAYS` must stay in step with the 30 days in `remove-wheels.yml` and the policy section of `README.md`.
+
+Tests live in `tests/test_check_stale_wheels.py` and run with `uv run --frozen tests/test_check_stale_wheels.py`.
+They stub the network, so they are fast and safe to run anywhere.
+Every case in them is a real package whose metadata would break a naive implementation; add to that table rather than replacing it when the resolution logic changes.
+
+Issues opened in other projects are posted by [@scientific-python-bot](https://github.com/scientific-python-bot) using a classic token with the `public_repo` scope, stored as the `ISSUE_OPENER_TOKEN` secret.
+Be conservative with anything that posts outward: those messages arrive unsolicited in other maintainers' inboxes.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..8b7cbf4
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
+See [AGENTS.md](AGENTS.md).
diff --git a/README.md b/README.md
index 9bb9dcf..c8bbe4d 100644
--- a/README.md
+++ b/README.md
@@ -86,6 +86,53 @@ In addition cron jobs in GitHub repositories will be disabled after a certain am
 We are not aware of a solution other than regular commit activity to prevent the deactivation of
 scheduled cron jobs.
 
+## Stale wheel reminders
+
+So that the removal above does not come as a surprise, a daily job in this repository checks how
+long ago each package was last uploaded. If it has been more than **15 days**, the job opens an
+issue on that project's own issue tracker naming the date its wheels will be removed, comments once
+more at **25 days**, and closes the issue automatically once a new wheel is uploaded. Issues are opened
+by [@scientific-python-bot][bot]; the repository to report to is taken from the project's PyPI
+metadata (`Project-URL`), so keeping those URLs pointed at your GitHub repository is enough to be
+reachable.
+
+[bot]: https://github.com/scientific-python-bot
+
+The check runs daily from `tools/check_stale_wheels.py` in this repository, an hour before the
+cleanup job that does the deleting. If your project's PyPI metadata carries no GitHub URL we can
+follow, we have no way to reach you: the run records that in an issue here instead, and the fix is
+either to add a `Project-URL` upstream or to ask us to map the package by hand. Maintainers of this
+repository: the workflow posts with `ISSUE_OPENER_TOKEN`, a token belonging to the bot account with
+the `public_repo` scope, and falls back to the workflow's own `GITHUB_TOKEN` when reporting here.
+
+## Reporting a failing scheduled workflow
+
+A cron job that quietly stops working can go unnoticed for months, which is the same problem the
+reminders above exist to solve. The scheduled workflows here each call `report-failure.yml`, a small
+reusable workflow that opens one issue when a run fails and rewrites that issue on later failures
+rather than adding a comment a day.
+
+Other projects are welcome to call it too:
+
+```yml
+jobs:
+  nightly:
+    ...
+
+  report-failure:
+    needs: [nightly]
+    if: failure() && github.event_name == 'schedule'
+    permissions:
+      issues: write
+    uses: scientific-python/upload-nightly-action/.github/workflows/report-failure.yml@main
+    with:
+      title: 'The nightly wheel build is failing'
+```
+
+The issue is opened in the calling repository by `github-actions[bot]`, using that workflow's own
+`GITHUB_TOKEN`, so no secret is needed. The `title` doubles as the identity of the issue, so keep it
+stable. As with the action itself, we recommend pinning to a specific SHA rather than to `main`.
+
 
 # Using nightly builds in CI
 
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..08f240f
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,11 @@
+# Dependencies of the Python tools in this repository, and the only place their
+# versions are declared. Run a tool with:
+#
+#     uv run --with-requirements requirements.txt <script>
+#
+# Pin exactly rather than with a range: Dependabot leaves a range alone while the
+# newest release still satisfies it, so a range would give neither pinning nor
+# update pull requests.
+PyGithub==2.9.1   # check_stale_wheels.py: reading, opening and closing issues
+pytest==9.1.1     # tests/
+requests==2.34.2  # check_stale_wheels.py: the anaconda.org and PyPI APIs
diff --git a/tests/test_check_stale_wheels.py b/tests/test_check_stale_wheels.py
new file mode 100755
index 0000000..1f8fcc2
--- /dev/null
+++ b/tests/test_check_stale_wheels.py
@@ -0,0 +1,120 @@
+#!/usr/bin/env python
+"""Tests for ``tools/check_stale_wheels.py``."""
+
+import re
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "tools"))
+
+import check_stale_wheels
+
+# Real metadata, trimmed to the keys that matter. Every case here is one that a
+# package on the channel actually exercises.
+CASES = {
+    # The tracker wins over equally valid alternatives.
+    "scikit-learn": (
+        {
+            "source": "https://github.com/scikit-learn/scikit-learn",
+            "tracker": "https://github.com/scikit-learn/scikit-learn/issues",
+            "download": "https://pypi.org/project/scikit-learn/#files",
+        },
+        "scikit-learn/scikit-learn",
+    ),
+    # github.com/orgs/<name> is not a repository, and must not win over the real one.
+    "scikit_build_core": (
+        {
+            "Discussions": "https://github.com/orgs/scikit-build/discussions",
+            "Homepage": "https://github.com/scikit-build/scikit-build-core",
+        },
+        "scikit-build/scikit-build-core",
+    ),
+    # An unrecognized key ("upstream") must not beat a recognized one.
+    "scipy-openblas32": (
+        {
+            "homepage": "https://github.com/MacPython/openblas-libs",
+            "upstream": "https://github.com/OpenMathLib/OpenBLAS",
+        },
+        "MacPython/openblas-libs",
+    ),
+    # Deep links are trimmed back to owner/repo. This one is also a repository that
+    # has since been renamed, which resolve() canonicalizes separately.
+    "awkward": (
+        {"Bug Tracker": "https://github.com/scikit-hep/awkward-1.0/issues"},
+        "scikit-hep/awkward-1.0",
+    ),
+    # A blob URL is still only useful for the owner/repo part.
+    "python-flint": (
+        {
+            "Changelog": "https://github.com/flintlib/python-flint/blob/master/README.md#changelog",
+            "Repository": "https://github.com/flintlib/python-flint",
+        },
+        "flintlib/python-flint",
+    ),
+    # home_page is folded in under a key we recognize.
+    "pyproj": ({"home": "https://github.com/pyproj4/pyproj"}, "pyproj4/pyproj"),
+    # Hyphenated and spaced spellings of the same keys both count.
+    "xarray": (
+        {
+            "issue-tracker": "https://github.com/pydata/xarray/issues",
+            "source-code": "https://github.com/pydata/xarray",
+        },
+        "pydata/xarray",
+    ),
+    # A repository visible only through a key that doesn't name it is not trusted;
+    # such a project needs a PYPI_MAP entry rather than a guess.
+    "changelog-only": ({"Changelog": "https://github.com/foo/bar/releases"}, None),
+    # Nothing on GitHub: PYPI_MAP has to cover these.
+    "icechunk": ({"Homepage": "https://icechunk.io", "Docs": "https://docs.earthmover.io"}, None),
+    "nothing-at-all": ({}, None),
+}
+
+
+@pytest.fixture
+def project_urls(monkeypatch):
+    """Serve canned PyPI metadata instead of hitting the network."""
+
+    def fake(name):
+        return CASES[name][0]
+
+    monkeypatch.setattr(check_stale_wheels, "pypi_project_urls", fake)
+
+
+@pytest.mark.parametrize("name", list(CASES))
+def test_repo_from_pypi(project_urls, name):
+    assert check_stale_wheels.repo_from_pypi(name) == CASES[name][1]
+
+
+@pytest.mark.parametrize(
+    "url, expected",
+    [
+        ("https://github.com/foo/bar.git", "foo/bar"),
+        ("http://github.com/foo/bar", "foo/bar"),
+        ("https://www.github.com/foo/bar", "foo/bar"),
+        ("https://GitHub.com/Foo/Bar", "Foo/Bar"),
+        ("https://github.com/foo/bar#readme", "foo/bar"),
+        ("https://gitlab.com/foo/bar", None),
+        ("https://github.com/orgs/foo/discussions", None),
+        ("https://example.com", None),
+    ],
+)
+def test_repo_from_pypi_url_forms(monkeypatch, url, expected):
+    monkeypatch.setattr(check_stale_wheels, "pypi_project_urls", lambda name: {"source": url})
+    assert check_stale_wheels.repo_from_pypi("whatever") == expected
+
+
+def test_policy_url_anchor_exists():
+    """The issues we open link to a README heading, which can be renamed away."""
+    readme = (Path(__file__).resolve().parent.parent / "README.md").read_text()
+    anchors = set()
+    for line in readme.splitlines():
+        if line.startswith("#"):
+            heading = line.lstrip("#").strip().lower()
+            anchors.add(re.sub(r"\s+", "-", re.sub(r"[^\w\s-]", "", heading)))
+    assert check_stale_wheels.POLICY_URL.split("#", 1)[1] in anchors
+
+
+if __name__ == "__main__":
+    sys.exit(pytest.main([__file__, "-v"]))
diff --git a/tools/check_stale_wheels.py b/tools/check_stale_wheels.py
new file mode 100755
index 0000000..d7bdcf2
--- /dev/null
+++ b/tools/check_stale_wheels.py
@@ -0,0 +1,466 @@
+#!/usr/bin/env python
+"""Report projects whose nightly wheels are about to be removed from the channel.
+
+Wheels older than the retention period are deleted by ``remove-wheels.yml``, which
+can leave a project with no nightly wheels at all and break downstream CI. This
+script runs on a schedule from this repository, finds packages whose most recent
+upload is older than the warning threshold, and opens an issue on the project's
+own tracker so the maintainers hear about it before the wheels disappear.
+
+Requires ``ISSUE_OPENER_TOKEN`` (a classic token with the ``public_repo`` scope,
+used to open issues on other projects) and ``GITHUB_TOKEN`` (used only to report
+here when a project's tracker can't be reached).
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import sys
+import urllib.parse
+from collections import defaultdict
+from concurrent.futures import ThreadPoolExecutor
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import requests
+from github import Auth, Github, GithubException
+
+ANACONDA_USER = "scientific-python-nightly-wheels"
+ANACONDA_API = "https://api.anaconda.org"
+CHANNEL_URL = f"https://anaconda.org/{ANACONDA_USER}"
+ACTION_URL = "https://github.com/scientific-python/upload-nightly-action"
+POLICY_URL = f"{ACTION_URL}#artifact-cleanup-policy-at-the-scientific-python-nightly-wheels-channel"
+
+# Hidden markers let us find our own issues and comments again without relying on
+# the (fuzzy, eventually consistent) search API. Changing one silently orphans every
+# issue already carrying it, so treat them as permanent.
+MARKER = "<!-- scientific-python-nightly-wheels: stale-wheels -->"
+FINAL_WARNING_MARKER = "<!-- scientific-python-nightly-wheels: stale-wheels-final -->"
+REPORT_MARKER = "<!-- scientific-python-nightly-wheels: stale-wheels-report -->"
+
+# Open an issue once wheels are this old, follow up once at FINAL_WARNING_DAYS, and
+# keep RETENTION_DAYS in step with remove-wheels.yml, which does the deleting.
+WARN_DAYS = 15
+FINAL_WARNING_DAYS = 25
+RETENTION_DAYS = 30
+
+# Don't nag again about a package whose issue was closed without a new upload
+# until this much time has passed.
+RENOTIFY_DAYS = 60
+
+# Packages whose GitHub repository can't be discovered from their PyPI metadata.
+# Prefer fixing Project-URL metadata upstream over adding entries here.
+PYPI_MAP = {
+    "icechunk": "earth-mover/icechunk",
+}
+
+SCRIPT = Path(__file__).name
+IGNORE_FILE = Path(__file__).resolve().parent.parent / "packages-ignore-from-cleanup.txt"
+SESSION = requests.Session()
+SESSION.headers["User-Agent"] = "scientific-python-upload-nightly-action"
+
+# Ambient run configuration, set once by main().
+GH: Github = None
+LOGIN = ""
+DRY_RUN = False
+
+_GITHUB_REPO_RE = re.compile(
+    r"^https?://(?:www\.)?github\.com/(?!orgs/)([^/]+)/([^/#?]+)", re.IGNORECASE
+)
+# Substrings of the Project-URL keys that name a project's own repository, best
+# first. Matching on substrings covers "Bug Tracker", "issue-tracker", and friends;
+# keys naming something else ("Changelog", "Discussions", "upstream") are ignored.
+_REPO_URL_KEYS = ("tracker", "issues", "source", "repository", "homepage", "home")
+# Everything we treat as "this package could not be checked" rather than a crash.
+REPORTABLE = (GithubException, RuntimeError, requests.RequestException)
+
+
+def fetch(url):
+    """Read JSON from a public API (anaconda.org, PyPI), or None if missing."""
+    response = SESSION.get(url, timeout=60)
+    if response.status_code == 404:
+        return None
+    response.raise_for_status()
+    return response.json()
+
+
+@dataclass
+class Package:
+    name: str
+    last_upload: datetime | None = None
+    repo: object = None  # github.Repository, once resolved
+    status: str = ""
+    issue_url: str | None = None
+    error: str | None = None
+
+    def age_days(self, now):
+        return (now - self.last_upload).days
+
+
+def list_packages():
+    """Return every package currently on the channel."""
+    return [package["name"] for package in fetch(f"{ANACONDA_API}/packages/{ANACONDA_USER}")]
+
+
+def last_upload_time(name):
+    """Return the newest upload time across every version of ``name``.
+
+    ``latest_version`` is not reliable here: nightly version strings are not
+    ordered consistently across projects, so an older release can sort last.
+    """
+    package = fetch(f"{ANACONDA_API}/package/{ANACONDA_USER}/{name}")
+    if package is None:
+        return None
+    uploads = []
+    for version in package["versions"]:
+        quoted = urllib.parse.quote(version, safe="")
+        release = fetch(f"{ANACONDA_API}/release/{ANACONDA_USER}/{name}/{quoted}")
+        for distribution in (release or {}).get("distributions", []):
+            uploads.append(datetime.fromisoformat(distribution["upload_time"]))
+    if not uploads:
+        return None
+    return max(uploads).astimezone(timezone.utc)
+
+
+def read_ignored(path):
+    """Read the package names that are exempt from automated cleanup."""
+    names = set()
+    for line in Path(path).read_text().splitlines():
+        line = line.split("#", 1)[0].strip()
+        if line:
+            names.add(line)
+    return names
+
+
+def pypi_project_urls(name):
+    """Return a package's PyPI Project-URLs, keyed as the project wrote them."""
+    info = fetch(f"https://pypi.org/pypi/{urllib.parse.quote(name)}/json")
+    if info is None:
+        return {}
+    urls = dict(info["info"].get("project_urls") or {})
+    if info["info"].get("home_page"):
+        urls.setdefault("home", info["info"]["home_page"])
+    return urls
+
+
+def repo_from_pypi(name):
+    """Find the ``owner/repo`` a package's PyPI metadata points at."""
+    candidates = []
+    for key, url in pypi_project_urls(name).items():
+        match = _GITHUB_REPO_RE.match(str(url))
+        if not match:
+            continue
+        key = key.strip().lower()
+        priority = next((i for i, want in enumerate(_REPO_URL_KEYS) if want in key), None)
+        if priority is None:
+            continue
+        owner, repo = match.groups()
+        candidates.append((priority, owner + "/" + repo.removesuffix(".git")))
+    if not candidates:
+        return None
+    return min(candidates)[1]
+
+
+def target_repo(name):
+    """Return the repository to report to, following renames."""
+    full_name = PYPI_MAP.get(name) or repo_from_pypi(name)
+    if full_name is None:
+        raise RuntimeError(
+            f"no GitHub repository found in the Project-URL metadata at "
+            f"https://pypi.org/project/{name}/ — add a tracker, source, repository, or "
+            f"homepage URL there, or add an entry to PYPI_MAP in {SCRIPT}"
+        )
+    repo = GH.get_repo(full_name)
+    if repo.archived:
+        raise RuntimeError(f"repository {repo.full_name} is archived")
+    if not repo.has_issues:
+        raise RuntimeError(f"repository {repo.full_name} has issues disabled")
+    return repo
+
+
+def resolve(name):
+    """Look up when a package was last uploaded and where to report about it."""
+    package = Package(name=name)
+    try:
+        package.last_upload = last_upload_time(name)
+        if package.last_upload is None:
+            raise RuntimeError("no wheels found on the channel")
+        package.repo = target_repo(name)
+    except REPORTABLE as exc:
+        package.status = "error"
+        package.error = f"`{name}`: {exc}"
+    return package
+
+
+def bot_issues(repo):
+    """Return this bot's issues on ``repo`` that carry our marker, newest first.
+
+    Deliberately unbounded in time: an issue we opened months ago and never
+    commented on again is exactly the one we must find, both to close it when
+    wheels reappear and to avoid opening a duplicate beside it. The list stays
+    short in practice, since a well-behaved run opens at most one per repository.
+    """
+    issues = repo.get_issues(state="all", creator=LOGIN, sort="created", direction="desc")
+    return [
+        issue for issue in issues if issue.pull_request is None and MARKER in (issue.body or "")
+    ]
+
+
+def describe(packages):
+    names = [f"`{package.name}`" for package in packages]
+    if len(names) == 1:
+        return names[0]
+    return ", ".join(names[:-1]) + " and " + names[-1]
+
+
+def issue_title(stale, age):
+    names = ", ".join(package.name for package in stale)
+    return f"No {names} nightly wheels uploaded in {age} days"
+
+
+def issue_body(stale, age, removal_date):
+    uploads = "\n".join(f"- `{package.name}`: {package.last_upload:%Y-%m-%d}" for package in stale)
+    return f"""\
+{MARKER}
+The most recent {describe(stale)} nightly wheels on the \
+[`{ANACONDA_USER}`]({CHANNEL_URL}) channel were uploaded **{age} days ago**:
+
+{uploads}
+
+Wheels are [removed after {RETENTION_DAYS} days]({POLICY_URL}), so unless a new nightly is \
+uploaded before **{removal_date:%Y-%m-%d}** there will be no wheels left on the channel at all, \
+and downstream projects that test against nightlies will fail to install them.
+
+Some things worth checking:
+
+- Is the workflow that builds and uploads the nightly wheels failing?
+- Was its scheduled run \
+[disabled by GitHub](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/disable-and-enable-a-workflow) \
+after a period of repository inactivity?
+- Has there simply been nothing to build? Consider uploading on a fixed cadence even when \
+nothing has changed, to keep the channel populated for downstream users.
+
+This issue was opened automatically from [scientific-python/upload-nightly-action]({ACTION_URL}), \
+and will be closed automatically once a new wheel is uploaded.
+"""
+
+
+def create_issue(repo, title, body):
+    if DRY_RUN:
+        print(f"  [dry run] would open an issue on {repo.full_name}: {title}")
+        return None
+    return repo.create_issue(title=title, body=body).html_url
+
+
+def comment(issue, body):
+    if DRY_RUN:
+        print(f"  [dry run] would comment on {issue.html_url}")
+        return
+    issue.create_comment(body)
+
+
+def close_issue(issue, body):
+    comment(issue, body)
+    if DRY_RUN:
+        print(f"  [dry run] would close {issue.html_url}")
+        return
+    issue.edit(state="closed", state_reason="completed")
+
+
+def handle_fresh(packages, issues):
+    """Close any issue we opened now that new wheels have shown up."""
+    for package in packages:
+        package.status = "ok"
+    open_issues = [issue for issue in issues if issue.state == "open"]
+    if not open_issues:
+        return
+    newest = max(package.last_upload for package in packages)
+    for issue in open_issues:
+        for package in packages:
+            package.status = "resolved"
+            package.issue_url = issue.html_url
+        close_issue(
+            issue, f"New nightly wheels were uploaded on {newest:%Y-%m-%d}. Thanks! Closing."
+        )
+
+
+def handle_stale(repo, stale, issues, now):
+    age = max(package.age_days(now) for package in stale)
+    oldest = min(package.last_upload for package in stale)
+    removal_date = oldest + timedelta(days=RETENTION_DAYS)
+    open_issues = [issue for issue in issues if issue.state == "open"]
+
+    def mark(status, url):
+        for package in stale:
+            package.status = status
+            package.issue_url = url
+
+    if not open_issues:
+        recent = [issue for issue in issues if (now - issue.created_at).days < RENOTIFY_DAYS]
+        if recent:
+            # An issue we opened was closed without new wheels appearing; give the
+            # project some quiet before raising it again.
+            mark("muted", recent[0].html_url)
+            return
+        url = create_issue(
+            repo,
+            issue_title(stale, age),
+            issue_body(stale, age, removal_date),
+        )
+        mark("opened", url)
+        return
+
+    issue = open_issues[0]
+    mark("reported", issue.html_url)
+    if age < FINAL_WARNING_DAYS:
+        return
+    if any(FINAL_WARNING_MARKER in (item.body or "") for item in issue.get_comments()):
+        return
+    mark("final warning", issue.html_url)
+    comment(
+        issue,
+        f"{FINAL_WARNING_MARKER}\nStill no new nightly wheels for {describe(stale)}. The "
+        f"remaining wheels are scheduled to be removed from the channel on "
+        f"**{removal_date:%Y-%m-%d}**.",
+    )
+
+
+def handle_repo(repo, packages, now):
+    """Open, update, or close one issue for every package built from ``repo``."""
+    stale = [package for package in packages if package.age_days(now) >= WARN_DAYS]
+    try:
+        issues = bot_issues(repo)
+        if stale:
+            handle_stale(repo, stale, issues, now)
+            for package in packages:
+                if package not in stale:
+                    package.status = "ok"
+        else:
+            handle_fresh(packages, issues)
+    except REPORTABLE as exc:
+        for package in packages:
+            package.status = "error"
+            package.error = f"`{package.name}` ({repo.full_name}): {exc}"
+
+
+def write_summary(packages, now):
+    lines = [
+        f"## Nightly wheel freshness ({now:%Y-%m-%d})",
+        "",
+        "| Package | Last upload | Age (days) | Repository | Status |",
+        "| --- | --- | --- | --- | --- |",
+    ]
+    epoch = datetime.min.replace(tzinfo=timezone.utc)
+    for package in sorted(packages, key=lambda p: p.last_upload or epoch):
+        age = "?" if package.last_upload is None else package.age_days(now)
+        upload = "?" if package.last_upload is None else f"{package.last_upload:%Y-%m-%d}"
+        name = package.repo.full_name if package.repo else None
+        repo = f"[{name}](https://github.com/{name})" if name else "—"
+        status = package.status
+        if package.issue_url:
+            status = f"[{status}]({package.issue_url})"
+        if package.error:
+            # Keep the table readable; the full text, including how to fix it, goes
+            # in the issue report_errors opens.
+            status = f"error: {package.error.split(': ', 1)[-1].split(' — ')[0]}"
+        elif age != "?" and age >= WARN_DAYS:
+            age = f"**{age}**"
+        lines.append(f"| {package.name} | {upload} | {age} | {repo} | {status} |")
+    summary = "\n".join(lines)
+    print(summary)
+    if os.environ.get("GITHUB_STEP_SUMMARY"):
+        with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as fid:
+            fid.write(summary + "\n")
+
+
+def report_errors(errors):
+    """Open (or update) an issue here about projects we could not reach.
+
+    This uses GITHUB_TOKEN rather than the bot's token: the thing that failed may
+    well be the bot's token itself.
+    """
+    run_id = os.environ.get("GITHUB_RUN_ID")
+    check = "stale wheel check"
+    if run_id:
+        server = os.environ.get("GITHUB_SERVER_URL", "https://github.com")
+        check = f"[{check}]({server}/{os.environ['GITHUB_REPOSITORY']}/actions/runs/{run_id})"
+    body = (
+        f"{REPORT_MARKER}\nThese packages are on the "
+        f"[`{ANACONDA_USER}`]({CHANNEL_URL}) channel, but the "
+        f"{check} could not work out where to report about them, so "
+        f"nobody will hear from us when their wheels are about to be removed:\n\n"
+        + "\n".join(f"- {error}" for error in errors)
+        + "\n\nThis list is rewritten on every run, and the issue can be closed once it is empty."
+    )
+    if DRY_RUN:
+        print(f"\n[dry run] could not report on {len(errors)} project(s):\n{body}")
+        return
+    home = Github(auth=Auth.Token(os.environ["GITHUB_TOKEN"])).get_repo(
+        os.environ.get("GITHUB_REPOSITORY", "scientific-python/upload-nightly-action")
+    )
+    existing = [
+        issue
+        for issue in home.get_issues(state="open")
+        if issue.pull_request is None and REPORT_MARKER in (issue.body or "")
+    ]
+    if not existing:
+        create_issue(home, "Could not report stale nightly wheels", body)
+    elif existing[0].body != body:
+        # Rewrite rather than comment: this runs daily, and an unfixed package would
+        # otherwise collect a comment a day. Editing notifies nobody.
+        existing[0].edit(body=body)
+
+
+def main(argv=None):
+    global GH, LOGIN, DRY_RUN
+
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument(
+        "--dry-run",
+        action="store_true",
+        help="report what would happen without opening, commenting on, or closing issues",
+    )
+    args = parser.parse_args(argv)
+
+    DRY_RUN = args.dry_run
+    for name in ("ISSUE_OPENER_TOKEN", "GITHUB_TOKEN"):
+        if not os.environ.get(name):
+            parser.error(f"{name} is not set")
+
+    GH = Github(auth=Auth.Token(os.environ["ISSUE_OPENER_TOKEN"]))
+    # An unusable token (usually expired) fails the run, which the workflow turns
+    # into an issue; report_errors only covers projects we could not reach.
+    LOGIN = GH.get_user().login
+    print(f"Acting as {LOGIN}")
+
+    # Packages exempt from the cleanup are also exempt from being nagged about,
+    # since their wheels are not going anywhere
+    ignored = read_ignored(IGNORE_FILE)
+    names = [name for name in list_packages() if name not in ignored]
+
+    now = datetime.now(timezone.utc)
+    # Most of the runtime is the ~5 read-only lookups each package needs; writes
+    # below stay serial.
+    with ThreadPoolExecutor(max_workers=4) as pool:
+        packages = list(pool.map(resolve, names))
+
+    # Several packages can be built from one repository; report them together.
+    by_repo = defaultdict(list)
+    for package in packages:
+        if package.repo is not None:
+            by_repo[package.repo.full_name].append(package)
+    for group in by_repo.values():
+        handle_repo(group[0].repo, group, now)
+
+    write_summary(packages, now)
+    errors = [package.error for package in packages if package.error]
+    if errors:
+        report_errors(errors)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())