Add prod (whl) S3 dependency updates gated behind promote-env (#8260)

## What
`update-s3-dependencies.yml` currently updates the S3 HTML dependency
listings for **nightly** and **test** only. This adds an opt-in path to
also
update **prod** (`whl`), gated behind the protected `promote-env`
(mirroring
`release-download-pytorch-org.yml`).

## Changes
- **Workflow**: new `include-prod` input (choice, default `disabled`)
and a
  new `update-prod` job that:
- runs `environment: promote-env` (so prod updates require the
environment's
    approval/protection rules),
- assumes `arn:aws:iam::749337293305:role/gha_workflow_promote_wheels`
and
    uses the prod R2 secrets (`R2_ACCOUNT_ID` / `R2_ACCESS_KEY_ID` /
`R2_SECRET_ACCESS_KEY`), matching `release-download-pytorch-org.yml`,
  - only runs in `update-packages` mode when `include-prod == enabled`.
- **`s3_management/update_dependencies.py`**: new `--stable-only` flag
so the
prod job updates only the `whl` prefix rather than redundantly rewriting
  `whl/nightly` and `whl/test` under the protected environment. Default
  behavior (nightly + test, and `--include-stable`) is unchanged.

## Behavior
- Default dispatch: unchanged — the existing `update` job updates
  nightly + test under `pytorchbot-env`.
- With `include-prod=enabled`: the `update-prod` job additionally
updates the
prod `whl` index for the selected package, subject to `promote-env`
approval.
- Honors the existing `dryrun` input.

## Not a duplicate
No existing open PR adds prod dependency updates / promote-env gating to
`update-s3-dependencies.yml`.

## Test plan
- `python -c "import ast; ast.parse(...)"` on `update_dependencies.py`
(OK).
- YAML parses; jobs are `update` + `update-prod`;
`update-prod.environment ==
  promote-env`; `include-prod` input present.
- Recommend a `dryrun=enabled`, `include-prod=enabled` dispatch to
confirm the
  prod job only touches the `whl` prefix.

AI assistance (Claude) was used for this change.

---------

Signed-off-by: Andrey Talman <atalman@users.noreply.github.com>
Co-authored-by: Andrey Talman <atalman@users.noreply.github.com>

Author: atalman

.github/workflows/update-s3-dependencies.yml

@@ -35,13 +35,24 @@ on:
         description: 'Target to create (e.g., rocm7.2, cu130) - only for create-target mode'
         required: false
         type: string
+      include-prod:
+        description: 'Update prod (whl) dependencies only, via promote-env (skips nightly/test; update-packages mode only)'
+        required: false
+        type: choice
+        default: disabled
+        options:
+          - disabled
+          - enabled
 
 permissions:
   id-token: write
   contents: read
 
 jobs:
+  # Nightly + test updates. Skipped when include-prod is enabled, so a prod
+  # run only touches prod (the update-prod job below) and never nightly/test.
   update:
+    if: ${{ github.event.inputs.include-prod != 'enabled' }}
     runs-on: ubuntu-22.04
     environment: pytorchbot-env
     container:
@@ -139,3 +150,50 @@ jobs:
 
           # shellcheck disable=SC2086
           python3 s3_management/update_dependencies.py ${ARGS}
+
+  # Prod (whl) dependency updates are gated behind the protected promote-env,
+  # mirroring release-download-pytorch-org.yml. Opt-in via the include-prod
+  # input; runs only in update-packages mode.
+  update-prod:
+    if: ${{ github.event.inputs.mode == 'update-packages' && github.event.inputs.include-prod == 'enabled' }}
+    runs-on: ubuntu-22.04
+    environment: promote-env
+    container:
+      image: continuumio/miniconda3:23.10.0-1
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        with:
+          role-to-assume: arn:aws:iam::749337293305:role/gha_workflow_promote_wheels
+          aws-region: us-east-1
+
+      - name: Checkout repository test-infra
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: pytorch/test-infra
+          ref: ${{ github.ref }}
+
+      - name: Install dependencies
+        run: |
+          pip install -r s3_management/requirements.txt
+
+      - name: Update prod (stable) packages
+        shell: bash
+        env:
+          DRYRUN: ${{ github.event.inputs.dryrun }}
+          PACKAGE: ${{ github.event.inputs.package || 'torch' }}
+          R2_ACCOUNT_ID: ${{ secrets.R2_ACCOUNT_ID }}
+          R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          R2_BUCKET_NAME: "pytorch-downloads"
+        run: |
+          set -ex
+
+          ARGS="--package ${PACKAGE} --stable-only"
+
+          if [[ "${DRYRUN}" == "enabled" ]]; then
+            ARGS="${ARGS} --dry-run"
+          fi
+
+          # shellcheck disable=SC2086
+          python3 s3_management/update_dependencies.py ${ARGS}

s3_management/update_dependencies.py

@@ -1329,6 +1329,11 @@ def main() -> None:
     parser.add_argument("--package", choices=project_paths, default="torch")
     parser.add_argument("--dry-run", action="store_true")
     parser.add_argument("--include-stable", action="store_true")
+    parser.add_argument(
+        "--stable-only",
+        action="store_true",
+        help="Update only the stable/prod prefix (whl), skipping nightly and test",
+    )
 
     # Arguments for target creation
     parser.add_argument(
@@ -1407,9 +1412,13 @@ def main() -> None:
         return
 
     # Original behavior: update all dependencies for specified package
-    SUBFOLDERS = ["whl/nightly", "whl/test"]
-    if args.include_stable:
-        SUBFOLDERS.append("whl")
+    if args.stable_only:
+        # Prod-only update (gated behind the promote-env in CI).
+        SUBFOLDERS = ["whl"]
+    else:
+        SUBFOLDERS = ["whl/nightly", "whl/test"]
+        if args.include_stable:
+            SUBFOLDERS.append("whl")
 
     for prefix in SUBFOLDERS:
         # Process each package and its multiple configurations