There is some config validation logic in tricium/appengine/common/config/ for generating project configs, which is currently called when generating workflows.

However, upon config change, in the update-config RPC, we can also validate the config, which means it wouldn't need to be validated at workflow generation. At config ingestion time we could also check the set of all project configs to see whether there are any overlapping repos specified between projects.