Fixes #3756 by creating a new api_proto_library_internal build rule that

api/bazel/api_build_system.bzl

@@ -74,6 +74,17 @@ def api_go_grpc_library(name, proto, deps = []):
         ]
     )
 
+# This is api_proto_library plus some logic internal to //envoy/api.
+def api_proto_library_internal(visibility = ["//visibility:private"], **kwargs):
+    # //envoy/docs/build.sh needs visibility in order to generate documents.
+    if visibility == ["//visibility:private"]:
+      visibility = ["//docs"]
+    elif visibility != ["//visibility:public"]:
+      visibility = visibility + ["//docs"]
+
+    api_proto_library(visibility=visibility, **kwargs)
+
+
 # TODO(htuch): has_services is currently ignored but will in future support
 # gRPC stub generation.
 # TODO(htuch): Automatically generate go_proto_library and go_grpc_library
@@ -86,11 +97,6 @@ def api_proto_library(name, visibility = ["//visibility:private"], srcs = [], de
     # it can play well with the PGV plugin and (2) other language support that
     # can make use of native proto_library.
 
-    if visibility == ["//visibility:private"]:
-      visibility = ["//docs"]
-    elif visibility != ["//visibility:public"]:
-      visibility = visibility + ["//docs"]
-
     native.proto_library(
         name = name,
         srcs = srcs,

api/envoy/admin/v2alpha/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "config_dump",
     srcs = ["config_dump.proto"],
     visibility = ["//visibility:public"],
@@ -14,7 +14,7 @@ api_proto_library(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "clusters",
     srcs = ["clusters.proto"],
     visibility = ["//visibility:public"],
@@ -26,7 +26,7 @@ api_proto_library(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "metrics",
     srcs = ["metrics.proto"],
     visibility = ["//visibility:public"],

api/envoy/api/v2/BUILD

@@ -1,4 +1,4 @@
-load("//bazel:api_build_system.bzl", "api_go_grpc_library", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_grpc_library", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
@@ -16,7 +16,7 @@ package_group(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "discovery",
     srcs = ["discovery.proto"],
     visibility = [":friends"],
@@ -29,7 +29,7 @@ api_go_proto_library(
     deps = ["//envoy/api/v2/core:base_go_proto"],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "eds",
     srcs = ["eds.proto"],
     has_services = 1,
@@ -55,7 +55,7 @@ api_go_grpc_library(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "cds",
     srcs = ["cds.proto"],
     has_services = 1,
@@ -95,7 +95,7 @@ api_go_grpc_library(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "lds",
     srcs = ["lds.proto"],
     has_services = 1,
@@ -119,7 +119,7 @@ api_go_grpc_library(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "rds",
     srcs = ["rds.proto"],
     has_services = 1,

api/envoy/api/v2/auth/BUILD

@@ -1,4 +1,4 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
@@ -15,7 +15,7 @@ package_group(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "cert",
     srcs = ["cert.proto"],
     visibility = [":friends"],

api/envoy/api/v2/cluster/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "circuit_breaker",
     srcs = ["circuit_breaker.proto"],
     visibility = [
@@ -21,7 +21,7 @@ api_go_proto_library(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "outlier_detection",
     srcs = ["outlier_detection.proto"],
     visibility = [

api/envoy/api/v2/core/BUILD

@@ -1,4 +1,4 @@
-load("//bazel:api_build_system.bzl", "api_go_grpc_library", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_grpc_library", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
@@ -16,7 +16,7 @@ package_group(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "address",
     srcs = ["address.proto"],
     visibility = [
@@ -31,7 +31,7 @@ api_go_proto_library(
     deps = [":base_go_proto"],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "base",
     srcs = ["base.proto"],
     visibility = [
@@ -44,7 +44,7 @@ api_go_proto_library(
     proto = ":base",
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "health_check",
     srcs = ["health_check.proto"],
     visibility = [
@@ -59,7 +59,7 @@ api_go_proto_library(
     deps = [":base_go_proto"],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "config_source",
     srcs = ["config_source.proto"],
     visibility = [
@@ -85,15 +85,15 @@ api_go_proto_library(
     proto = ":http_uri",
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "http_uri",
     srcs = ["http_uri.proto"],
     visibility = [
         ":friends",
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "grpc_service",
     srcs = ["grpc_service.proto"],
     visibility = [
@@ -108,7 +108,7 @@ api_go_proto_library(
     deps = [":base_go_proto"],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "protocol",
     srcs = ["protocol.proto"],
     visibility = [

api/envoy/api/v2/endpoint/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "endpoint",
     srcs = ["endpoint.proto"],
     visibility = ["//envoy/api/v2:friends"],
@@ -29,7 +29,7 @@ api_go_proto_library(
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "load_report",
     srcs = ["load_report.proto"],
     visibility = ["//envoy/api/v2:friends"],

api/envoy/api/v2/listener/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "listener",
     srcs = ["listener.proto"],
     visibility = ["//envoy/api/v2:friends"],

api/envoy/api/v2/ratelimit/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "ratelimit",
     srcs = ["ratelimit.proto"],
     visibility = ["//envoy/api/v2:friends"],

api/envoy/api/v2/route/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "route",
     srcs = ["route.proto"],
     visibility = ["//envoy/api/v2:friends"],

api/envoy/config/accesslog/v2/BUILD

@@ -1,16 +1,16 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "als",
     srcs = ["als.proto"],
     deps = [
         "//envoy/api/v2/core:grpc_service",
     ],
 )
 
-api_proto_library(
+api_proto_library_internal(
     name = "file",
     srcs = ["file.proto"],
 )

api/envoy/config/bootstrap/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "bootstrap",
     srcs = ["bootstrap.proto"],
     visibility = ["//visibility:public"],

api/envoy/config/filter/accesslog/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "accesslog",
     srcs = ["accesslog.proto"],
     visibility = [

api/envoy/config/filter/fault/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "fault",
     srcs = ["fault.proto"],
     visibility = [

api/envoy/config/filter/http/buffer/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "buffer",
     srcs = ["buffer.proto"],
 )

api/envoy/config/filter/http/ext_authz/v2alpha/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "ext_authz",
     srcs = ["ext_authz.proto"],
     deps = [

api/envoy/config/filter/http/fault/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "fault",
     srcs = ["fault.proto"],
     deps = [

api/envoy/config/filter/http/gzip/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "gzip",
     srcs = ["gzip.proto"],
 )

api/envoy/config/filter/http/header_to_metadata/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "header_to_metadata",
     srcs = ["header_to_metadata.proto"],
     deps = [],

api/envoy/config/filter/http/health_check/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_go_proto_library", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "health_check",
     srcs = ["health_check.proto"],
     deps = [

api/envoy/config/filter/http/ip_tagging/v2/BUILD

@@ -1,8 +1,8 @@
-load("//bazel:api_build_system.bzl", "api_proto_library")
+load("//bazel:api_build_system.bzl", "api_proto_library_internal")
 
 licenses(["notice"])  # Apache 2
 
-api_proto_library(
+api_proto_library_internal(
     name = "ip_tagging",
     srcs = ["ip_tagging.proto"],
     deps = ["//envoy/api/v2/core:address"],