fix(release): run pinned async versions on their own variables, map CLI key-creation errors, show GitLab tokens as the current block

apps/sim/app/api/cli/auth/poll/route.ts

@@ -3,6 +3,7 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { pollCliAuthContract } from '@/lib/api/contracts'
 import { parseRequest } from '@/lib/api/server'
 import {
+  apiKeyCreationErrorStatus,
   performCreatePersonalApiKey,
   performCreateWorkspaceApiKey,
 } from '@/lib/api-key/orchestration'
@@ -83,7 +84,7 @@ async function mintForGrant(
   if (!result.success || !result.key) {
     return {
       ok: false,
-      status: result.errorCode === 'conflict' ? 409 : 500,
+      status: apiKeyCreationErrorStatus(result.errorCode),
       message: result.error ?? 'Failed to generate API key',
     }
   }

apps/sim/background/workflow-execution.ts

@@ -286,7 +286,8 @@ export async function executeWorkflowJob(
         /**
          * The version this run executes, loaded once: the core runs this same version's
          * blocks, so a deploy landing mid-setup cannot pair one version's variables with
-         * another's graph.
+         * another's graph. A pinned version runs with only its own snapshot, as a sync run
+         * of it does, never the editor's current variables.
          */
         const pinnedDeploymentVersionId = payload.pinnedDeploymentVersionId
         const deployedState = await withDatabaseReadRetry(
@@ -328,7 +329,9 @@ export async function executeWorkflowJob(
           metadata,
           workflow,
           payload.input,
-          resolveDeployedRunVariables(deployedState, workflow.variables),
+          pinnedDeploymentVersionId
+            ? (deployedState.variables ?? {})
+            : resolveDeployedRunVariables(deployedState, workflow.variables),
           []
         )
 

apps/sim/lib/integrations/credential-display.ts

@@ -22,6 +22,7 @@ import { CANONICAL_SERVICE_ACCOUNT_SLUGS } from '@/lib/integrations/oauth-servic
 import { OAUTH_PROVIDERS } from '@/lib/oauth/oauth'
 import type { OAuthProvider, OAuthServiceConfig } from '@/lib/oauth/types'
 import { getServiceConfigByProviderId, parseProvider } from '@/lib/oauth/utils'
+import { resolveAccessControlBlockType } from '@/lib/permission-groups/integration-allowlist'
 
 /**
  * Above this many covered integrations the subtitle states a count instead of
@@ -226,7 +227,7 @@ export function resolveCredentialDisplay(credential: DisplayableCredential): Cre
     return {
       service: null,
       integration,
-      blockType: 'gitlab',
+      blockType: resolveAccessControlBlockType('gitlab'),
       icon: GitlabIcon,
       familyName: null,
       coveredIntegrations: integration ? [integration] : [],

docker/pii.Dockerfile

@@ -47,8 +47,9 @@ COPY --chown=pii:pii --chmod=755 docker/pii-entrypoint.sh ./
 # copies the image's /tmp into a bind volume mounted at a VOLUME path. The
 # VOLUME line stays below the model download, which stages wheels in /tmp.
 # tldextract (pulled in by Presidio) caches the Public Suffix List under
-# $HOME/.cache by default; point it at /tmp so it caches instead of
-# refetching the list on every start.
+# $HOME/.cache by default, which the read-only root cannot write; point it at
+# the writable /tmp volume. That volume is per task, so each task fetches the
+# list once.
 ENV PYTHONDONTWRITEBYTECODE=1 \
     TLDEXTRACT_CACHE=/tmp/tldextract
 RUN chmod 1777 /tmp