OrgID for propagation

pkg/capabilities/v2/actions/confidentialrelay/types.go

@@ -138,6 +138,7 @@ type CapabilityRequestParams struct {
 	WorkflowID   string `json:"workflow_id"`
 	Owner        string `json:"owner"`
 	ExecutionID  string `json:"execution_id"`
+	OrgID        string `json:"org_id,omitempty"` // propagated into capability.RequestMetadata when CRE setting enables it
 	ReferenceID  string `json:"reference_id"`
 	CapabilityID string `json:"capability_id"`
 	Payload      string `json:"payload"`
@@ -302,6 +303,7 @@ func writeCapabilityRequestParams(h hash.Hash, params CapabilityRequestParams) {
 	writeString(h, params.WorkflowID)
 	writeString(h, params.Owner)
 	writeString(h, params.ExecutionID)
+	writeString(h, params.OrgID)
 	writeString(h, params.ReferenceID)
 	writeString(h, params.CapabilityID)
 	writeString(h, params.Payload)

pkg/capabilities/v2/actions/confidentialrelay/types_test.go

@@ -158,6 +158,10 @@ func TestCapabilityResponseResultHash_IgnoresAttestationAndBindsRequestAndRespon
 	differentRequest.ReferenceID = "43"
 	require.NotEqual(t, mustCapabilityHash(t, result, params), mustCapabilityHash(t, result, differentRequest))
 
+	differentOrg := params
+	differentOrg.OrgID = "org-other"
+	require.NotEqual(t, mustCapabilityHash(t, result, params), mustCapabilityHash(t, result, differentOrg))
+
 	differentResponse := result
 	differentResponse.Error = "boom"
 	require.NotEqual(t, mustCapabilityHash(t, result, params), mustCapabilityHash(t, differentResponse, params))