Key Buildkite map on immutable IDs instead of renameable slugs

Switch _extract_repo_buildkite to read organization_id and
pipeline_id claims (UUIDs, immutable) rather than organization_slug
and pipeline_slug (renameable, can be reclaimed by another org).

This prevents identity hijacking via slug rename: a released slug
claimed by a different organization would no longer silently match
an existing mapping entry.

ci_providers.yml format changes from:
  vllm/ci: vllm-project/vllm
to:
  org-uuid/pipeline-uuid: vllm-project/vllm  # vllm/ci

Author: subinz1

aws/lambda/cross_repo_ci_relay/config/ci_providers.yml

@@ -6,13 +6,17 @@
 # Format: one top-level key per CI provider.  Each provider section maps
 # the provider's pipeline identifier to the GitHub repo it represents.
 #
+# IMPORTANT: Buildkite mappings use immutable organization_id/pipeline_id
+# (UUIDs) rather than slugs.  Slugs are renameable and a released slug
+# can be claimed by a different organization; IDs are permanent.
+# Find IDs via: buildkite-agent oidc request-token --audience <aud>
+#
 # The Lambda fetches this file at runtime (via CI_PROVIDERS_URL) and
 # caches it in Redis, so changes here take effect without redeployment.
 
 buildkite:
-  # org_slug/pipeline_slug: owner/repo
-  # vllm/ci: vllm-project/vllm
-  # vllm/release: vllm-project/vllm
+  # organization_id/pipeline_id: owner/repo  # slug (for readability)
+  # 018e4f2a-1b2c-3d4e/018e5a6b-7c8d-9e0f: vllm-project/vllm  # vllm/ci
 
 # gitlab:
 #   group/project: owner/repo

aws/lambda/cross_repo_ci_relay/tests/test_jwt_helper.py

@@ -25,6 +25,8 @@ def _fake_github_claims(**overrides):
 def _fake_buildkite_claims(**overrides):
     base = {
         "iss": BUILDKITE_ISSUER,
+        "organization_id": "org-uuid-123",
+        "pipeline_id": "pipe-uuid-456",
         "organization_slug": "myorg",
         "pipeline_slug": "mypipeline",
         "build_commit": "abc123",
@@ -135,7 +137,7 @@ def setUp(self):
         self.mock_decode = self.patcher_decode.start()
 
         self._orig_map = BUILDKITE_REPO_MAP.copy()
-        load_ci_provider_mappings({"buildkite": {"myorg/mypipeline": "myorg/myrepo"}})
+        load_ci_provider_mappings({"buildkite": {"org-uuid-123/pipe-uuid-456": "myorg/myrepo"}})
 
     def tearDown(self):
         self.patcher_detect.stop()
@@ -155,21 +157,21 @@ def test_valid_buildkite_token_returns_mapped_repo(self):
 
     def test_unregistered_pipeline_raises_403(self):
         self.mock_decode.return_value = _fake_buildkite_claims(
-            organization_slug="unknown", pipeline_slug="unknown"
+            organization_id="unknown-org", pipeline_id="unknown-pipe"
         )
         with self.assertRaises(HTTPException) as ctx:
             verify_oidc_token("bk.oidc.token")
         self.assertEqual(ctx.exception.status_code, 403)
         self.assertIn("not registered", ctx.exception.detail)
 
-    def test_missing_org_slug_raises_401(self):
-        self.mock_decode.return_value = _fake_buildkite_claims(organization_slug="")
+    def test_missing_org_id_raises_401(self):
+        self.mock_decode.return_value = _fake_buildkite_claims(organization_id="")
         with self.assertRaises(HTTPException) as ctx:
             verify_oidc_token("bk.oidc.token")
         self.assertEqual(ctx.exception.status_code, 401)
 
-    def test_missing_pipeline_slug_raises_401(self):
-        self.mock_decode.return_value = _fake_buildkite_claims(pipeline_slug="")
+    def test_missing_pipeline_id_raises_401(self):
+        self.mock_decode.return_value = _fake_buildkite_claims(pipeline_id="")
         with self.assertRaises(HTTPException) as ctx:
             verify_oidc_token("bk.oidc.token")
         self.assertEqual(ctx.exception.status_code, 401)
@@ -193,10 +195,10 @@ def tearDown(self):
         BUILDKITE_REPO_MAP.update(self._orig_map)
 
     def test_loads_valid_buildkite_entries(self):
-        raw = {"buildkite": {"vllm/ci": "vllm-project/vllm", "acme/build": "acme/repo"}}
+        raw = {"buildkite": {"org-id-1/pipe-id-1": "vllm-project/vllm", "org-id-2/pipe-id-2": "acme/repo"}}
         load_ci_provider_mappings(raw)
-        self.assertEqual(BUILDKITE_REPO_MAP[("vllm", "ci")], "vllm-project/vllm")
-        self.assertEqual(BUILDKITE_REPO_MAP[("acme", "build")], "acme/repo")
+        self.assertEqual(BUILDKITE_REPO_MAP[("org-id-1", "pipe-id-1")], "vllm-project/vllm")
+        self.assertEqual(BUILDKITE_REPO_MAP[("org-id-2", "pipe-id-2")], "acme/repo")
 
     def test_empty_config_clears_map(self):
         BUILDKITE_REPO_MAP[("old", "entry")] = "old/repo"
@@ -209,10 +211,10 @@ def test_missing_buildkite_section_clears_map(self):
         self.assertEqual(len(BUILDKITE_REPO_MAP), 0)
 
     def test_skips_invalid_entries(self):
-        raw = {"buildkite": {"noslash": "vllm-project/vllm", "ok/pipeline": "ok/repo"}}
+        raw = {"buildkite": {"noslash": "vllm-project/vllm", "ok-id/pipe-id": "ok/repo"}}
         load_ci_provider_mappings(raw)
         self.assertNotIn(("noslash", ""), BUILDKITE_REPO_MAP)
-        self.assertEqual(BUILDKITE_REPO_MAP[("ok", "pipeline")], "ok/repo")
+        self.assertEqual(BUILDKITE_REPO_MAP[("ok-id", "pipe-id")], "ok/repo")
 
 
 class TestUnsupportedIssuer(unittest.TestCase):

aws/lambda/cross_repo_ci_relay/utils/jwt_helper.py

@@ -34,9 +34,10 @@
     issuer: jwt.PyJWKClient(cfg["jwks_uri"]) for issuer, cfg in _ISSUER_CONFIG.items()
 }
 
-# Runtime-populated mapping from Buildkite (org_slug, pipeline_slug) to the
-# GitHub-style "owner/repo" identity.  Loaded from the ci_providers.yml
-# config file so that adding a new downstream repo only requires a config
+# Runtime-populated mapping from Buildkite (organization_id, pipeline_id) to
+# the GitHub-style "owner/repo" identity.  Uses immutable IDs rather than
+# slugs to prevent identity hijacking via slug rename.  Loaded from
+# ci_providers.yml so adding a new downstream repo only requires a config
 # change — no Lambda redeployment.
 BUILDKITE_REPO_MAP: Dict[Tuple[str, str], str] = {}
 
@@ -129,18 +130,18 @@ def _extract_repo_github(claims: dict) -> str:
 
 
 def _extract_repo_buildkite(claims: dict) -> str:
-    org = claims.get("organization_slug", "")
-    pipeline = claims.get("pipeline_slug", "")
-    if not org or not pipeline:
+    org_id = claims.get("organization_id", "")
+    pipeline_id = claims.get("pipeline_id", "")
+    if not org_id or not pipeline_id:
         raise HTTPException(
             401,
-            "Buildkite OIDC token missing 'organization_slug' or 'pipeline_slug'",
+            "Buildkite OIDC token missing 'organization_id' or 'pipeline_id'",
         )
-    repo = BUILDKITE_REPO_MAP.get((org, pipeline))
+    repo = BUILDKITE_REPO_MAP.get((org_id, pipeline_id))
     if not repo:
         raise HTTPException(
             403,
-            f"Buildkite pipeline {org}/{pipeline} is not registered with CRCR",
+            f"Buildkite pipeline {org_id}/{pipeline_id} is not registered with CRCR",
         )
     return repo