meh, shouldn't skylark-based generation of configs paper over repetitive nature of config?

it is not only about repetition. Project-level configs is our API and we are requiring users to specify the buildbucket hostname, like there may me multiple different buildbucket hosts for a given LUCI deployment.

My motivation to file this bug was to reduce attack surface (scheduler schedules builds  in different buckets / projects/ buildbucket servers). The context was go/luci-buckets. However, after that I've realized that other instances of buildbucket wouldn't allow a different luci-scheduler to schedule builds.

By buildbucket hostname, you mean the appengine hostname?

I mean what’s being specified now, “cr-buildbucket.appspot.com”