feat: share the scheduled-failure report as a reusable workflow

[lesnik512]

Replaces the 26 per-repo copies of .github/scripts/report-scheduled-failure.sh with one reusable workflow here: .github/workflows/report-scheduled-failure.yml.

Why

The copies drifted. The "Likely cause" sentence lists dependency names, and each repo's copy edited its own list. Six of those lists named typing-extensions in a repo that doesn't depend on it: eof-fixer, db-retry, jwks-client, release-scope, semvertag and faststream-concurrent-aiokafka. The modern-di integrations carried the same stale entry until this week. Apart from that sentence, all 26 scripts are byte-identical, and so is every repo's report-failure job.

The new message is generic. It says a dependency or Python release broke the build and points at the linked run, which shows the failing job.

Relation to #95

#95 rejected a shared _checks.yml because workflow_call inputs are scalars, which forced service containers and env maps into strings. This workflow takes no inputs, which matches the shape #95's closing comment suggests if the idea is ever reopened. The only per-repo variation today is compose2pod's note that its integration and conformance jobs need podman and docker. That note is dropped: the linked run shows which job failed.

Changes

• New .github/workflows/report-scheduled-failure.yml (on: workflow_call, no inputs). It has the same label, title and find-or-comment logic as the script. It sets GH_REPO because it runs without a checkout, and it gets its issues: write permission from the caller.
• Standard CI2 now requires the caller job byte for byte and forbids a per-repo script. Like CI9, it tracks main unpinned.
• The links.yml comment that pointed at the per-repo script now points at the shared workflow.

Each repo's job becomes:

  report-failure:
    needs: checks
    if: failure() && github.event_name == 'schedule'
    permissions:
      issues: write
    uses: modern-python/.github/.github/workflows/report-scheduled-failure.yml@main

Verification

• actionlint 1.7.12 passes on this repo's workflows. It also passes on a converted caller (modern-di-flask's scheduled.yml with the job above), linted both against a local copy of the shared workflow, which checks the call and permissions, and in the remote uses: form.
• uv run pytest passes (173 tests), and so does mkdocs build --strict.
• Tested end to end from this branch in eof-fixer, using a throwaway workflow that called report-scheduled-failure.yml@shared-scheduled-failure-report on push:
  • The first run (https://github.com/modern-python/eof-fixer/actions/runs/37194147641) created the label and opened Scheduled dependency check failed eof-fixer#59. Its run link points at eof-fixer's run, not this repo's.
  • The second run (https://github.com/modern-python/eof-fixer/actions/runs/37194211294) commented "Failed again" on #59 and did not open a duplicate.
  • #59 is closed as not planned, and the throwaway branch is deleted.