[CRCR] Add multi-issuer OIDC support to jwt_helper for Buildkite (#8453)

## Summary

Adds multi-issuer OIDC support to the CRCR relay, enabling downstream
repos running on **any supported CI platform** (currently GitHub Actions
+ Buildkite) to authenticate callbacks.

### Architecture

```
ci_providers.yml (in test-infra)        allowlist.yml (in pytorch/pytorch)
    ┌─────────────────────┐                ┌─────────────────┐
    │ buildkite:          │                │ L1: [...]        │
    │   vllm/ci: vllm/vllm│               │ L2: [...]        │
    │ # gitlab:           │                │ L3: {device: ..} │
    │ #   grp/proj: o/r   │                │ L4: [...]        │
    └────────┬────────────┘                └────────┬────────┘
             │ CI_PROVIDERS_URL                      │ ALLOWLIST_URL
             ▼                                       ▼
    ┌─────────────────────────────────────────────────────────┐
    │                  CRCR Lambda                            │
    │  jwt_helper.py    →  verify OIDC token (any issuer)     │
    │  allowlist.py     →  check repo trust level             │
    │  lambda_function  →  orchestrate                        │
    └─────────────────────────────────────────────────────────┘
```

### Changes

| File | What |
|------|------|
| `config/ci_providers.yml` | **New** — external CI provider
pipeline-to-repo mapping, extensible per provider |
| `utils/jwt_helper.py` | Multi-issuer OIDC: detect issuer → select JWKS
→ extract repo. Loads mappings from `ci_providers.yml` via URL + Redis
cache |
| `utils/config.py` | Add optional `ci_providers_url` field |
| `utils/redis_helper.py` | Add `get_cached_ci_providers` /
`set_cached_ci_providers` with separate Redis key |
| `callback/lambda_function.py` | Call `load_ci_providers(config)`
before token verification |
| `utils/allowlist.py` | Unchanged (reverted) |
| `tests/test_jwt_helper.py` | Expanded from 5 → 17 tests |

### Onboarding a new Buildkite repo

Edit `config/ci_providers.yml` — no Lambda redeployment needed:

```yaml
buildkite:
  vllm/ci: vllm-project/vllm
  acme/build: acme/repo
```

### Onboarding a new CI provider (future)

1. Add the provider's JWKS endpoint to `_ISSUER_CONFIG` in
`jwt_helper.py`
2. Add an `_extract_repo_<provider>` function
3. Add a section reader in `load_ci_provider_mappings`
4. Add the provider section to `ci_providers.yml`

Closes #8326

## Test plan
- [x] All 17 unit tests pass locally
- [ ] CI passes (lintrunner, python-tests)
- [ ] Set `CI_PROVIDERS_URL` env var and deploy to staging
- [ ] Verify with a test Buildkite OIDC token

Author: subinz1

aws/lambda/cross_repo_ci_relay/callback/lambda_function.py

@@ -46,11 +46,11 @@ def lambda_handler(event, context):
         config = get_config()
         body = json.loads(body_bytes) if body_bytes else {}
 
-        # OIDC is the only identity check Relay performs.  The callback body is
-        # passed through to HUD untouched — HUD owns schema/business validation.
-        # Relay reports the OIDC-verified repo to HUD separately as
-        # `verified_repo` so HUD has a trusted source of truth for the
-        # caller's identity.
+        # Load external CI provider repo mappings (Buildkite, etc.) so
+        # verify_oidc_token can resolve non-GitHub OIDC tokens.  Cached
+        # in Redis; no-op when CI_PROVIDERS_URL is not configured.
+        jwt_helper.load_ci_providers(config)
+
         oidc_claims = jwt_helper.verify_oidc_token(headers.get("authorization", ""))
         verified_repo = oidc_claims["repository"]
 

aws/lambda/cross_repo_ci_relay/config/ci_providers.yml

@@ -0,0 +1,43 @@
+# External CI Provider → GitHub Repo Mapping for CRCR OIDC
+#
+# CI platforms that don't carry a native "repository" OIDC claim need an
+# explicit mapping from their pipeline identity to a GitHub owner/repo.
+#
+# IMPORTANT: Buildkite mappings use immutable organization_id/pipeline_id
+# (UUIDs) rather than slugs.  Slugs are renameable and a released slug
+# can be claimed by a different organization; IDs are permanent.
+# Find IDs via: buildkite-agent oidc request-token --audience <aud>
+#
+# SECURITY: By default, any build in a mapped pipeline can authenticate.
+# If a pipeline runs fork-PR builds, use required_claims to restrict
+# which builds are authorized (e.g. only builds on specific branches).
+# Pipelines that do NOT expose OIDC to fork builds are safe without
+# required_claims.
+#
+# The Lambda fetches this file at runtime (via CI_PROVIDERS_URL) and
+# caches it in Redis, so changes here take effect without redeployment.
+
+buildkite:
+  # Simple format (pipeline does not run fork builds):
+  #   organization_id/pipeline_id: owner/repo
+  #
+  # Constrained format (pipeline may run fork builds):
+  #   organization_id/pipeline_id:
+  #     repo: owner/repo
+  #     required_claims:
+  #       build_branch: [main, nightly]  # only these branches can auth
+  #       cluster_id: specific-cluster-uuid
+
+  # Example entries:
+  # 018e4f2a-1b2c-3d4e/018e5a6b-7c8d-9e0f: vllm-project/vllm
+  #
+  # 018e4f2a-1b2c-3d4e/018e9a0b-1c2d-3e4f:
+  #   repo: vllm-project/vllm
+  #   required_claims:
+  #     build_branch: [main, release]
+
+# gitlab:
+#   group/project: owner/repo
+
+# jenkins:
+#   job-name: owner/repo

aws/lambda/cross_repo_ci_relay/tests/test_callback_handler_lambda.py

@@ -48,26 +48,29 @@ def test_invalid_json_body_returns_400(self, mock_get_config):
         response = lambda_handler(_event(body="not-json"), {})
         self.assertEqual(response["statusCode"], 400)
 
+    @patch("callback.lambda_function.jwt_helper.load_ci_providers")
     @patch("callback.lambda_function.get_config")
-    def test_missing_authorization_header_returns_401(self, mock_get_config):
+    def test_missing_authorization_header_returns_401(self, mock_get_config, _):
         response = lambda_handler(_event(headers={}), {})
         self.assertEqual(response["statusCode"], 401)
         self.assertIn("Missing", json.loads(response["body"])["detail"])
 
+    @patch("callback.lambda_function.jwt_helper.load_ci_providers")
     @patch("callback.lambda_function.get_config")
     @patch("callback.lambda_function.jwt_helper.verify_oidc_token")
-    def test_oidc_failure_returns_401(self, mock_oidc, mock_get_config):
+    def test_oidc_failure_returns_401(self, mock_oidc, mock_get_config, _):
         mock_oidc.side_effect = HTTPException(401, "Invalid authorization token")
 
         response = lambda_handler(_event(), {})
 
         self.assertEqual(response["statusCode"], 401)
 
+    @patch("callback.lambda_function.jwt_helper.load_ci_providers")
     @patch("callback.lambda_function.get_config")
     @patch("callback.lambda_function.jwt_helper.verify_oidc_token")
     @patch("callback.lambda_function.callback_handler.handle")
     def test_happy_path_forwards_body_and_verified_repo(
-        self, mock_handle, mock_oidc, mock_get_config
+        self, mock_handle, mock_oidc, mock_get_config, _
     ):
         mock_oidc.return_value = {"repository": "org/repo"}
         mock_handle.return_value = {"ok": True, "status": "completed"}
@@ -83,13 +86,13 @@ def test_happy_path_forwards_body_and_verified_repo(
         self.assertEqual(args[1], {"status": "completed", "head_sha": "abc123"})
         self.assertEqual(args[2], "org/repo")
 
+    @patch("callback.lambda_function.jwt_helper.load_ci_providers")
     @patch("callback.lambda_function.get_config")
     @patch("callback.lambda_function.jwt_helper.verify_oidc_token")
     @patch("callback.lambda_function.callback_handler.handle")
     def test_hud_error_from_handler_is_forwarded(
-        self, mock_handle, mock_oidc, mock_get_config
+        self, mock_handle, mock_oidc, mock_get_config, _
     ):
-        # HUD's HTTP status propagates out of Relay (transparent proxy).
         mock_oidc.return_value = {"repository": "org/repo"}
         mock_handle.side_effect = HTTPException(503, "HUD unreachable")
 
@@ -98,11 +101,12 @@ def test_hud_error_from_handler_is_forwarded(
         self.assertEqual(response["statusCode"], 503)
         self.assertEqual(json.loads(response["body"])["detail"], "HUD unreachable")
 
+    @patch("callback.lambda_function.jwt_helper.load_ci_providers")
     @patch("callback.lambda_function.get_config")
     @patch("callback.lambda_function.jwt_helper.verify_oidc_token")
     @patch("callback.lambda_function.callback_handler.handle")
     def test_unhandled_exception_returns_500(
-        self, mock_handle, mock_oidc, mock_get_config
+        self, mock_handle, mock_oidc, mock_get_config, _
     ):
         mock_oidc.return_value = {"repository": "org/repo"}
         mock_handle.side_effect = Exception("boom")