fix(webhooks): resolve env var references before deploy-triggered subscription creation

[waleedlatif1]

Summary

• Provider config fields (e.g. an API key) can reference an env var via {{VAR_NAME}}. The interactive trigger-save route (app/api/webhooks/route.ts) already resolved these before calling a provider's createSubscription, but the async deployment-outbox path (workflow deploy -> saveTriggerWebhooksForDeploy -> createExternalWebhookSubscription) did not.
• That meant a workflow deployed with an env-var-backed API key sent the literal, unresolved {{VAR_NAME}} string to the provider as the credential, which the provider correctly rejects (e.g. Ashby returns 401 "Invalid API Key").
• Fixed by resolving env vars inside createExternalWebhookSubscription itself, so both callers get consistent behavior. The persisted providerConfig still stores the unresolved template — only the outbound provider call gets the resolved value.
• Scoped to the ~23 providers that implement createSubscription (auto webhook-lifecycle registration). Providers without it (e.g. Slack) never touch this path — their env var resolution already happens correctly in the separate inbound-request verification path (processor.ts).

Type of Change

• Bug fix

Testing

• Added apps/sim/lib/webhooks/provider-subscriptions.test.ts: env vars resolve before the provider call, persisted config stays unresolved, providers without createSubscription skip resolution entirely.
• Full webhook suite (426 tests) passes.
• bunx turbo run type-check --filter=sim --force clean (confirmed one unrelated pre-existing failure in providers/meta/index.ts exists identically on unmodified staging, unaffected by this change).
• bun run check:api-validation passes.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 12, 2026 4:30am

[cursor]

PR Summary

Medium Risk
Touches credential handling for deploy-triggered external webhook registration; behavior is narrowed to providers with createSubscription and aligns with an existing resolver used elsewhere.

Overview
createExternalWebhookSubscription now resolves {{ENV_VAR}} placeholders in providerConfig (via resolveWebhookProviderConfig) before invoking a provider’s createSubscription, so deploy/outbox registration matches the interactive webhook-save path and providers receive real credentials instead of literal template strings.

Returned updatedProviderConfig still keeps unresolved templates; only providerConfigUpdates from the provider are merged in. Providers without createSubscription skip env resolution entirely. Workspace env lookup uses workflow.workspaceId when it’s a string, otherwise personal-only resolution.

Adds provider-subscriptions.test.ts covering resolution at call time, persisted unresolved config, workspace fallback, and the no-createSubscription path.

^{Reviewed by Cursor Bugbot for commit 69bcb97. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes env-var-backed webhook provider config during external subscription creation. The main changes are:

• Resolves {{ENV_VAR}} references before calling provider createSubscription.
• Keeps the persisted provider config unresolved while merging provider-managed updates.
• Adds tests for resolved outbound config, persistence behavior, non-string workspace IDs, and providers without automatic subscription creation.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/lib/webhooks/provider-subscriptions.ts	Moves webhook provider config resolution into the shared external subscription helper and preserves unresolved config for storage.
apps/sim/lib/webhooks/provider-subscriptions.test.ts	Adds tests for env-var resolution, persistence shape, workspace ID fallback, and unsupported provider behavior.

_{Reviews (2): Last reviewed commit: "fix(webhooks): guard against a non-strin..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 69bcb97. Configure here.}