Woodpecker CI, the open-source CI/CD engine for automating builds, tests, and deployments, enabling developers to define pipelines that automatically run on code changes, has released version 3.17.
One important change is the automatic generation of the gRPC secret used for communication between the Woodpecker server and its agents. This reduces manual configuration and helps prevent deployments from relying on weak or missing shared secrets. The release also updates the kin-openapi Go module to version 0.144 to address a security issue.
Woodpecker CI 3.17 also tightens control over Kubernetes pipelines by placing the nodeSelector step configuration behind an agent-side setting. Pipeline authors can no longer freely direct workloads to specific Kubernetes nodes unless administrators explicitly allow it via the agent configuration.
Moreover, the Web UI can now display workflow runtime errors, making it easier to distinguish failures in workflow preparation or execution from errors in individual pipeline steps. Related fixes ensure ordinary step failures are not incorrectly classified as workflow runtime errors.
For users running pipelines through the Docker backend, the release introduces an option to assign custom AppArmor profiles to containers, providing administrators another way to restrict container behavior and apply host-level security policies to pipeline workloads.
Kubernetes handling has also received broader internal improvements. The project reworked utility functions for resource names and labels, corrected the formatting of Kubernetes step labels, and added labels with trusted commit branch and event information to pipeline pods.
Another change makes matrix axis permutation ordering deterministic. Pipelines generated from the same matrix configuration are created in a consistent order rather than varying between runs. Woodpecker’s Prometheus metrics also gain a step-type label for step-level data, giving operators supplementary context when monitoring pipeline activity.
Server administrators can now configure permissions for the Unix socket, while release and tag pipeline data structures have been reworked. As part of this reformation, the CI_COMMIT_PRERELEASE environment variable has been renamed to CI_PIPELINE_RELEASE_PRE, which may require updates to pipelines referencing the old variable.
On the bug-fix side, secrets are now fetched again when a pipeline restarts, ensuring reruns use current values rather than outdated data. The release also fixes pipeline creation retries, prevents zero-minute timeout values, corrects default template data for queued pipelines, and improves dependency-cycle checks involving filtered optional dependencies.
Several Web UI issues involving component cleanup, composition resets, and tab ordering have also been resolved. On the server side, the release corrects user and repository handling related to forge IDs and includes a repair mechanism for users left with a forge_id value of zero when registration is closed.
For additional details, see the changelog.
