From ff5d4c0014edb3790c64df9c1b082eaf98b2fefb Mon Sep 17 00:00:00 2001
From: Huy Do <huydo@meta.com>
Date: Thu, 8 Oct 2026 15:36:00 -0700
Subject: [PATCH] Build the docker image from a ciflow/docker label

---
 .github/labeler.yml                |  5 +++++
 .github/pytorch-probot.yml         |  3 +++
 .github/workflows/docker-build.yml | 10 +++++-----
 3 files changed, 13 insertions(+), 5 deletions(-)
 create mode 100644 .github/labeler.yml

diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 00000000000..d1a7c744ed1
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,5 @@
+"ciflow/docker":
+  globs:
+    - .ci/docker/**
+    - .github/workflows/docker-build.yml
+  draft: false
diff --git a/.github/pytorch-probot.yml b/.github/pytorch-probot.yml
index 6d0e8803efb..606596e520e 100644
--- a/.github/pytorch-probot.yml
+++ b/.github/pytorch-probot.yml
@@ -1 +1,4 @@
 tracking_issue: 1896
+ciflow_push_tags:
+- ciflow/docker
+labeler_config: labeler.yml
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index ead908e9097..b95f90d298f 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -2,16 +2,16 @@ name: Docker Build
 
 on:
   workflow_dispatch:
-  pull_request:
-    paths:
-      - .ci/docker/**
-      - .github/workflows/docker-builds.yml
   push:
     branches:
       - main
+    # A fork PR gets no OIDC token to push to ECR, so a PR opts in with the
+    # ciflow/docker label instead, which pushes this tag from the base repo.
+    tags:
+      - ciflow/docker/*
     paths:
       - .ci/docker/**
-      - .github/workflows/docker-builds.yml
+      - .github/workflows/docker-build.yml
 
 jobs:
   docker-build: