fix(webhooks): clean up stale deployment-version webhooks during deploy

saveTriggerWebhooksForDeploy only inspected webhooks matching the version
being deployed; webhooks pinned to older deployment versions were left
untouched. Removing them was delegated to a separate, best-effort
CLEANUP_INACTIVE outbox event that dead-letters silently on failure. When
that event didn't complete, old-version webhooks lingered as is_active
orphans that fetchActiveWebhooks skips (version mismatch), so they
silently stopped polling.

Fold old-version webhook cleanup into the same registration pass: collect
webhooks pinned to a different (non-null) deployment version and route them
through the existing external-teardown + delete path, so a successful
deploy guarantees only the active version has webhooks. Null-version
webhooks are left untouched, matching CLEANUP_INACTIVE semantics.

Author: waleedlatif1

apps/sim/lib/webhooks/deploy.test.ts

@@ -0,0 +1,105 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { selectRows, deleteSpy, cleanupCalls, cleanupSpy } = vi.hoisted(() => ({
+  selectRows: { current: [] as Array<Record<string, unknown>> },
+  deleteSpy: vi.fn(() => ({ where: vi.fn(() => Promise.resolve(undefined)) })),
+  cleanupCalls: [] as string[],
+  cleanupSpy: vi.fn(async (wh: { id: string }) => {
+    cleanupCalls.push(wh.id)
+  }),
+}))
+
+vi.mock('@sim/db', () => ({
+  db: {
+    select: () => ({ from: () => ({ where: () => Promise.resolve(selectRows.current) }) }),
+    delete: deleteSpy,
+    transaction: async (cb: (tx: unknown) => Promise<unknown>) =>
+      cb({ insert: () => ({ values: () => Promise.resolve(undefined) }) }),
+  },
+}))
+vi.mock('@sim/db/schema', () => ({
+  account: {},
+  credentialSetMember: {},
+  webhook: { id: 'webhook.id', workflowId: 'webhook.workflowId' },
+  workflowDeploymentVersion: {},
+}))
+vi.mock('drizzle-orm', () => ({
+  and: vi.fn(),
+  eq: vi.fn((field: unknown, value: unknown) => ({ field, value })),
+  inArray: vi.fn(),
+  isNotNull: vi.fn(),
+  isNull: vi.fn(),
+  or: vi.fn(),
+}))
+vi.mock('@/lib/webhooks/provider-subscriptions', () => ({
+  cleanupExternalWebhook: cleanupSpy,
+  createExternalWebhookSubscription: vi.fn(),
+  shouldRecreateExternalWebhookSubscription: vi.fn(() => false),
+}))
+vi.mock('@/lib/webhooks/providers', () => ({ getProviderHandler: vi.fn() }))
+vi.mock('@/lib/webhooks/utils.server', () => ({
+  findConflictingWebhookPathOwner: vi.fn(),
+  syncWebhooksForCredentialSet: vi.fn(),
+}))
+vi.mock('@/lib/webhooks/pending-verification', () => ({
+  PendingWebhookVerificationTracker: class {
+    async register() {}
+    async clearAll() {}
+  },
+}))
+vi.mock('@/lib/oauth', () => ({ getProviderIdFromServiceId: vi.fn() }))
+vi.mock('@/lib/workflows/subblocks/visibility', () => ({ buildCanonicalIndex: vi.fn() }))
+vi.mock('@/blocks', () => ({ getBlock: vi.fn() }))
+vi.mock('@/triggers', () => ({ getTrigger: vi.fn(), isTriggerValid: vi.fn(() => false) }))
+vi.mock('@/triggers/constants', () => ({ SYSTEM_SUBBLOCK_IDS: new Set<string>() }))
+
+import { saveTriggerWebhooksForDeploy } from '@/lib/webhooks/deploy'
+
+function baseInput(deploymentVersionId?: string) {
+  return {
+    request: {} as never,
+    workflowId: 'wf-1',
+    workflow: {},
+    userId: 'user-1',
+    blocks: {},
+    requestId: 'req-1',
+    deploymentVersionId,
+  }
+}
+
+describe('saveTriggerWebhooksForDeploy — stale deployment-version cleanup', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    cleanupCalls.length = 0
+    selectRows.current = []
+  })
+
+  it('tears down older-version webhooks while preserving null-version webhooks', async () => {
+    selectRows.current = [
+      { id: 'stale-old', workflowId: 'wf-1', blockId: 'b1', deploymentVersionId: 'ver-old' },
+      { id: 'null-version', workflowId: 'wf-1', blockId: 'b2', deploymentVersionId: null },
+    ]
+
+    const result = await saveTriggerWebhooksForDeploy(baseInput('ver-active'))
+
+    expect(result.success).toBe(true)
+    expect(cleanupCalls).toContain('stale-old')
+    expect(deleteSpy).toHaveBeenCalledTimes(1)
+    expect(cleanupCalls).not.toContain('null-version')
+  })
+
+  it('does nothing to other-version webhooks when no deploymentVersionId is given', async () => {
+    selectRows.current = [
+      { id: 'some-version', workflowId: 'wf-1', blockId: 'b1', deploymentVersionId: 'ver-x' },
+    ]
+
+    const result = await saveTriggerWebhooksForDeploy(baseInput(undefined))
+
+    expect(result.success).toBe(true)
+    expect(cleanupCalls).toHaveLength(0)
+    expect(deleteSpy).not.toHaveBeenCalled()
+  })
+})

apps/sim/lib/webhooks/deploy.ts

@@ -452,7 +452,18 @@ async function syncCredentialSetWebhooks(params: {
 
 /**
  * Saves trigger webhook configurations as part of workflow deployment.
- * Uses delete + create approach for changed/deleted webhooks.
+ * Uses a delete + create approach for changed/deleted webhooks.
+ *
+ * Also removes webhooks pinned to an older (non-active) deployment version of this
+ * workflow. `fetchActiveWebhooks` only polls webhooks whose version matches the active
+ * one, so leaving stale-version rows in place strands them as live-but-never-polled
+ * orphans. Folding their teardown into this pass guarantees a successful deploy leaves
+ * only the active version's webhooks, rather than relying on the separate, best-effort
+ * `CLEANUP_INACTIVE` outbox event. Webhooks with a null version are left untouched, the
+ * same scope `CLEANUP_INACTIVE` uses.
+ *
+ * The sole caller only invokes this for the active deployment version (it skips the sync
+ * when the version is no longer active), so non-matching rows are always genuinely stale.
  */
 export async function saveTriggerWebhooksForDeploy({
   request,
@@ -477,12 +488,18 @@ export async function saveTriggerWebhooksForDeploy({
     .from(webhook)
     .where(and(eq(webhook.workflowId, workflowId), isNull(webhook.archivedAt)))
 
-  // Separate webhooks by version: current deployment vs others
   const existingWebhooks: typeof allWorkflowWebhooks = []
+  const staleVersionWebhooks: typeof allWorkflowWebhooks = []
 
   for (const wh of allWorkflowWebhooks) {
     if (deploymentVersionId && wh.deploymentVersionId === deploymentVersionId) {
       existingWebhooks.push(wh)
+    } else if (
+      deploymentVersionId &&
+      wh.deploymentVersionId &&
+      wh.deploymentVersionId !== deploymentVersionId
+    ) {
+      staleVersionWebhooks.push(wh)
     }
   }
 
@@ -508,7 +525,7 @@ export async function saveTriggerWebhooksForDeploy({
   }
   const webhookConfigs = new Map<string, WebhookConfig>()
 
-  const webhooksToDelete: typeof existingWebhooks = []
+  const webhooksToDelete: typeof existingWebhooks = [...staleVersionWebhooks]
   const blocksNeedingWebhook: BlockState[] = []
   const blocksNeedingCredentialSetSync: BlockState[] = []