Woodpecker CI 3.20 adds manual workflow selection, agent restrictions, security fixes

Woodpecker CI, an open-source continuous integration and delivery platform, has released version 3.20 with substantial pipeline management and security enhancements. The update enables users to select specific workflows when manually triggering pipelines, a capability previously unavailable, and allows administrators to restrict organizations and users to dedicated agents for improved multi-tenant isolation.

Security improvements include removing agent tokens from process environments, preventing bearer credentials from appearing in trace-level logs, rotating repository JWTs during repair operations, and hardening configuration fetching. The release also speeds up queue scheduling calculations, preserves paused queue states across server restarts, and fixes multiple server crashes, Kubernetes backend misreporting, and Git hosting integration issues. A follow-up 3.20.1 release restores drone/envsubst functionality and corrects a web UI step log grouping regression introduced in 3.20.0.

Pipeline, security, and backend changes in Woodpecker CI 3.20

• Manual workflow selection: Users can now specify individual workflows when manually triggering pipelines, replacing the previous all-or-nothing execution model.
• Agent restriction and isolation: Administrators can bind organizations and users to their own agents, preventing pipeline execution leakage in shared Woodpecker instances.
• Credential and token hardening: Agent tokens are removed from process environments, bearer credentials are excluded from trace-level logs, repository JWTs rotate during repair operations, and failed permission synchronization falls back to read-only rather than broader access.
• Queue and scheduling reliability: Queue scheduling calculations are faster, paused queues persist through server restarts, and a bug where depends_on workflows could execute despite failed dependencies after queue reloads has been fixed.
• Kubernetes and Git hosting fixes: Kubernetes backend no longer marks deleted unknown-status pods as successful, invalid backend configurations now error properly, and OAuth token refreshing plus annotated tag resolution are corrected across GitHub, GitLab, Gitea, and Forgejo integrations.

Why it matters

For Linux-based CI/CD infrastructure and self-hosted DevOps environments, Woodpecker CI 3.20 reduces attack surface around agent credential exposure and multi-tenant agent sharing, addressing practical security concerns for organizations running their own automation. The scheduling and queue reliability improvements, combined with Kubernetes backend correctness fixes, benefit teams deploying containerized workloads on Linux infrastructure who depend on accurate pipeline state management.