From e55ea1ed7b19e561238d5fdc4147485612d70e06 Mon Sep 17 00:00:00 2001
From: Ryan Northey <ryan@synca.io>
Date: Tue, 12 May 2026 13:47:41 +0000
Subject: [PATCH] docs: Gate RBE/BES on GHCR auth probe for pull_request events

Signed-off-by: Ryan Northey <ryan@synca.io>
---
 .github/workflows/docs.yml | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index d9919523..1449019e 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -42,13 +42,30 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
       with:
         path: examples
-    - run: |
+    - name: RBE auth check
+      id: rbe
+      if: github.event_name == 'pull_request'
+      uses: envoyproxy/toolshed/actions/github/container/auth@f3c0acc8c3799305101f5669042b388edfb070c7
+      with:
+        container: hello-world
+    - name: Configure repo Bazel settings (base)
+      working-directory: envoy
+      run: |
         cat > repo.bazelrc <<'EOF'
-        common --config=ci
+        common --config=remote-ci
+        EOF
+        cat repo.bazelrc
+    - name: Configure repo Bazel settings (RBE/BES)
+      if: >-
+        github.event_name != 'pull_request'
+        || steps.rbe.outputs.authorized == 'true'
+      working-directory: envoy
+      run: |
+        cat >> repo.bazelrc <<'EOF'
         common --config=rbe
         common --config=bes
         EOF
-      working-directory: envoy
+        cat repo.bazelrc
 
     - run: |
         export UID