ci(moss): (4/4) add staging-to-production Exit Gate promotion

[chiajunglien]

Description

PR 4 of 4: Staging-to-Production Exit Gate (split from #5582 per review feedback; depends on #5601 and #5603).

This PR shifts the MaxText Docker image publishing model to push to maxtext-images-staging first, then promote to maxtext-images via the Artifact Registry :promoteArtifact Exit Gate using .github/scripts/promote_artifacts.sh (introduced in #5603):

• .github/workflows/build_and_push_docker_image.yml:
  • When inputs.repository_name is maxtext-images, builds and pushes the image to maxtext-images-staging (BUILD_REPO) first and runs SBOM generation/export against the staging image.
  • Promotes the image from maxtext-images-staging to maxtext-images via .github/scripts/promote_artifacts.sh, attaches the SPDX SBOM reference to the promoted image digest (using ${{ vars.SBOM_BUCKET }}), and applies the ${GITHUB_RUN_ID}, date, and maxtext_<sha>_<date> tags.
• .github/workflows/promote_docker_image.yml:
  • Promotes verified E2E images from maxtext-images-staging to maxtext-images via .github/scripts/promote_artifacts.sh before applying verified-e2e-<run_id> and latest tags.
• .github/workflows/pypi_release.yml:
  • In promote_docker_images, uploads the wheel SPDX SBOM reference (using ${{ vars.SBOM_BUCKET }}) and promotes the stable Docker images from maxtext-images-staging to maxtext-images via .github/scripts/promote_artifacts.sh before applying the ${PYPI_VERSION} tag.
• .github/workflows/promote_public_docker_image.yml:
  • Adds a manual workflow to promote public TPU Docker images in cloud-tpu-images from maxtext-images-staging to maxtext-images via .github/scripts/promote_artifacts.sh.

Tests

• Verified end-to-end staging-to-production promotion via :promoteArtifact (HTTP 200, done: true, bcidValidationResult.allowed: true, BCID VSA generated) in the TPU Docker Images Pipeline GitHub Actions workflow on tpu-prod-env-multipod.

Checklist

Before submitting this PR, please make sure (put X in square brackets):

• I have performed a self-review of my code. For an optional AI review, add the gemini-review label.
• I have necessary comments in my code, particularly in hard-to-understand areas.
• I have run end-to-end tests tests and provided workload links above if applicable.
• I have made or will make corresponding changes to the doc if needed, including adding new documentation pages to the relevant Table of Contents (toctree directive) as explained in our documentation.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!