ci: fail when a deny.toml advisory ignore outlives its reason

.github/workflows/ci-scripts.yml

@@ -21,6 +21,8 @@ on:
       - ci/test_check_proto_comments.py
       - ci/check_dependency_age.py
       - ci/test_check_dependency_age.py
+      - ci/check_advisory_ignores.py
+      - ci/test_check_advisory_ignores.py
       - ci/arrow_upgrade.py
       - ci/test_arrow_upgrade.py
       - ci/check_module_size.py
@@ -46,4 +48,4 @@ jobs:
       - name: Install test dependencies
         run: pip install pytest PyYAML
       - name: Run tests
-        run: pytest ci/test_format_vote_gate.py ci/test_labeler_area.py ci/test_check_proto_comments.py ci/test_check_dependency_age.py ci/test_arrow_upgrade.py ci/test_check_module_size.py
+        run: pytest ci/test_format_vote_gate.py ci/test_labeler_area.py ci/test_check_proto_comments.py ci/test_check_dependency_age.py ci/test_check_advisory_ignores.py ci/test_arrow_upgrade.py ci/test_check_module_size.py

.github/workflows/rust.yml

@@ -21,6 +21,7 @@ on:
       - clippy.toml
       - deny.toml
       - ci/check_dependency_age.py
+      - ci/check_advisory_ignores.py
       - ci/arrow_upgrade.py
 
 permissions:
@@ -117,6 +118,12 @@ jobs:
       # fetched. The script falls back to the network when that misses.
       - name: Check dependency age
         run: python3 ci/check_dependency_age.py
+      # Fails if an ignore in deny.toml has no `expires` or `no fix` marker, or
+      # its expires date has passed. It runs even if a step above failed, so
+      # one CI run reports every problem.
+      - name: Check advisory ignores
+        if: ${{ !cancelled() }}
+        run: python3 ci/check_advisory_ignores.py
 
   arrow-ordering-detect:
     # Lance inherits its comparison semantics from Arrow, DataFusion and `half`.