[ci] Run docs only for trusted PR branches

[SolitaryThinker]

Summary

• run the documentation PR workflow from the trusted base-branch definition
• execute MkDocs only for branches in hao-ai-lab/FastVideo; fork PRs skip before runner allocation or checkout
• restrict Pages/OIDC permissions, artifact upload, and deployment concurrency to main pushes

Why

Fork documentation runs currently stop at GitHub's action_required gate. The Full Suite cheap-check gate can then wait up to 25 minutes before failing open. Skipping executable docs builds for forks removes that delay without running fork-controlled MkDocs hooks, configuration, dependencies, or repository code under pull_request_target.

Security boundary

• the same-repository condition is evaluated at the job boundary before a runner starts
• the exact PR head is checked out only after head.repo.full_name == github.repository
• workflow-wide permissions are reduced to contents: read, and checkout credentials are not persisted
• Pages write/OIDC permissions and pages concurrency exist only on the main-push deployment job
• fork documentation changes remain covered by pre-commit, but the executable MkDocs build is deferred until merge

Test evidence

• pre-commit run --files .github/workflows/infra-docs.yml docs/contributing/ci_architecture.md
• git diff --check
• Ruby YAML parse
• static assertions for the fork guard, push-only deployment, and deploy-only permissions/concurrency
• independent read-only audit: no functional or security blockers after documenting the fork exception

No local pytest was run; this workflow-only change has no pytest surface.

[gemini-code-assist]

Code Review

This pull request updates the CI architecture documentation to clarify that the .github/workflows/infra-docs.yml workflow builds documentation only for same-repository pull requests, while fork pull requests skip this build to avoid waiting for maintainer approval. There are no review comments, so I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[mergify]

Merge Protections

🔴 1 of 1 protections blocking · waiting on 👀 reviews and 🤖 CI

	Protection	Waiting on
🔴	PR merge requirements	👀 reviews and 🤖 CI

🔴 PR merge requirements

Waiting for

• #approved-reviews-by>=1
• check-success=full-suite-passed

This rule is failing.

• #approved-reviews-by>=1
• check-success=full-suite-passed
• check-success=fastcheck-passed
• check-success~=pre-commit
• title~=(?i)^\[(feat|feature|bugfix|fix|refactor|perf|ci|doc|docs|misc|chore|kernel|new.?model|skill|skills|infra)\]