fix(tables): pin table workflow deployment state

Author: TheodoreSpeaks

apps/sim/background/workflow-column-execution.ts

@@ -993,6 +993,7 @@ async function runWorkflowAndWriteTerminal(
             workflowTriggerType: 'table',
             triggerBlockId: startBlock.id,
             useDraftState: false,
+            workflowStateOverride: normalizedData,
             abortSignal: attemptSignal,
             onBlockStart: progressWriter.onBlockStart,
             onBlockComplete: progressWriter.onBlockComplete,

apps/sim/lib/workflows/executor/execute-workflow.test.ts

@@ -234,6 +234,28 @@ describe('executeWorkflow', () => {
     )
   })
 
+  it('forwards a trusted immutable workflow state to the execution snapshot', async () => {
+    const workflowStateOverride = {
+      blocks: { 'block-1': { id: 'block-1', type: 'start_trigger' } },
+      edges: [],
+      loops: {},
+      parallels: {},
+      deploymentVersionId: 'deployment-version-1',
+    }
+
+    await executeWorkflow(workflow, 'request-1', { prompt: 'hello' }, 'actor-1', {
+      enabled: true,
+      principal,
+      billingAttribution,
+      workflowStateOverride,
+    })
+
+    const coreParams = executeWorkflowCoreMock.mock.calls[0]?.[0] as {
+      snapshot: ExecutionSnapshot
+    }
+    expect(coreParams.snapshot.metadata.workflowStateOverride).toEqual(workflowStateOverride)
+  })
+
   it('waits for post-execution persistence before resolving', async () => {
     let resolvePostExecution!: () => void
     waitForPostExecutionMock.mockReturnValueOnce(

apps/sim/lib/workflows/executor/execute-workflow.ts

@@ -48,6 +48,8 @@ export interface ExecuteWorkflowOptions {
   abortSignal?: AbortSignal
   /** Use the live/draft workflow state instead of the deployed state. Used by copilot. */
   useDraftState?: boolean
+  /** Immutable workflow state selected by a trusted server-side trigger boundary. */
+  workflowStateOverride?: NonNullable<ExecutionMetadata['workflowStateOverride']>
   /** Stop execution after this block completes. Used for "run until block" feature. */
   stopAfterBlockId?: string
   /** Run-from-block configuration using a prior execution snapshot. */
@@ -142,6 +144,7 @@ export async function executeWorkflow(
       triggerType,
       triggerBlockId: streamConfig?.triggerBlockId,
       useDraftState: streamConfig?.useDraftState ?? false,
+      workflowStateOverride: streamConfig?.workflowStateOverride,
       startTime: new Date().toISOString(),
       isClientSession: false,
       enforceCredentialAccess: streamConfig?.enforceCredentialAccess ?? false,

apps/sim/scripts/backfill-table-workflow-deployments.ts

@@ -115,7 +115,14 @@ async function assertTableWorkflowIntegrity(): Promise<void> {
     WHERE jsonb_typeof(workflow_group.value) IS DISTINCT FROM 'object'
       OR NOT (workflow_group.value ? 'workflowId')
       OR jsonb_typeof(workflow_group.value->'workflowId') IS DISTINCT FROM 'string'
-      OR workflow_group.value->>'workflowId' = ''
+      OR (
+        workflow_group.value->>'workflowId' = ''
+        AND (
+          NOT (workflow_group.value ? 'enrichmentId')
+          OR jsonb_typeof(workflow_group.value->'enrichmentId') IS DISTINCT FROM 'string'
+          OR workflow_group.value->>'enrichmentId' = ''
+        )
+      )
     LIMIT 1
   `)
   if (invalidGroup) {