Woodpecker is a fully open-source, self-hosted CI engine — you run the whole platform (server + agents) and define pipelines in YAML. KiCI brings typed-TypeScript pipelines and a managed control plane, so you keep execution sovereign without operating a CI server yourself.
Pipelines are real, typed TypeScript — loops, conditionals, functions, autocomplete
Pipelines are YAML — a workflow is a list of steps in a .woodpecker.yml file
Org-wide CI across repos
Push model: one workflow repo defines jobs that run on events from every matching repo in your org — selected by a repos: glob, with nothing added to the source repos themselves
Each repository carries its own .woodpecker.yaml, from which Woodpecker builds that repo’s pipeline
Source code and secrets
Your source and secrets stay on your own sovereign infrastructure, and KiCI runs the control plane as a managed service
Secrets are kept in Woodpecker’s own central secret store and injected into steps with from_secret — on the server you run
Self-hosting model
You self-host the execution (orchestrator and agents) on your own infrastructure, while KiCI runs the control plane as a managed service — no CI server to operate
Fully self-hosted — you run the server (UI, API, webhook processing) as well as the agents that execute workflows
Autoscaling ephemeral agents
A built-in auto-scaler provisions ephemeral agents on demand across Docker/Podman containers, bare-metal processes, and Firecracker microVMs — on your own infrastructure, with no extra controller
A separate autoscaler add-on can scale agents with the load (spinning up cloud VMs)
Dynamic job generation
Generate jobs programmatically in-process — a dynamicJob generator emits typed job definitions in TypeScript, fanning out one job per item an upstream job discovers
Built-in matrix workflows fan a workflow across combinations, but generation is matrix-bound rather than programmatic code
Testing & local dev loop
kici run --local and kici run remote run a full workflow from your current codebase — locally or against the real remote pipeline — before you commit or push
Pipelines run on your Woodpecker server when triggered by the forge — there is no equivalent that dry-runs the real remote pipeline from your local working tree before pushing
KiCI