generated: '2026-08-27'
method: derived
source: openapi/woodpecker-ci-server-swagger.json, json-schema/woodpecker-ci-pipeline-schema.json, grpc/woodpecker-ci-rpc.proto, https://woodpecker-ci.org/docs/
note: >-
  Cross-cutting and domain standards asserted against what the CONTRACTS actually declare,
  not against marketing claims. Woodpecker publishes no compliance certifications, so no
  Compliance pointer is emitted.
standards:
- id: openapi
  conforms: false
  evidence: >-
    The published contract is Swagger 2.0, not OpenAPI 3.x. `"swagger": "2.0"` in
    openapi/woodpecker-ci-server-swagger.json, generated by gin-swagger/swaggo and served
    at https://ci.woodpecker-ci.org/swagger/doc.json.
- id: swagger2
  conforms: true
  evidence: >-
    Valid Swagger 2.0 document: swagger 2.0, host ci.woodpecker-ci.org, basePath /api,
    74 paths, 118 operations, 51 definitions. Rendered by the project at
    https://woodpecker-ci.org/api.
- id: json-schema
  conforms: true
  version: draft-07
  evidence: >-
    json-schema/woodpecker-ci-pipeline-schema.json declares
    "$schema": "http://json-schema.org/draft-07/schema#" and
    "$id": "https://raw.githubusercontent.com/woodpecker-ci/woodpecker/main/pipeline/frontend/yaml/linter/schema/schema.json".
    It is the normative schema for `.woodpecker/` workflow files and is what the linter
    validates against.
- id: protobuf
  conforms: true
  version: proto3
  evidence: >-
    grpc/woodpecker-ci-rpc.proto declares `syntax = "proto3"`, package `proto`, and a
    `Woodpecker` service with 11 RPCs (Version, Next, Init, Wait, Done, Extend, Update,
    Log, RegisterAgent, UnregisterAgent, ReportHealth). This is the server-to-agent
    contract.
- id: grpc
  conforms: true
  evidence: >-
    Agents connect to the server over gRPC; the generated stubs (woodpecker_grpc.pb.go)
    ship in the same repository, and 3.18.0 added rejection of agents running an
    incompatible gRPC proto version.
- id: rfc9457
  conforms: false
  evidence: >-
    Errors are `text/plain` strings or empty bodies. No application/problem+json anywhere
    in the spec or on observed live responses. See errors/woodpecker-ci-problem-types.yml.
- id: pagination
  conforms: true
  style: page-number
  evidence: >-
    `page` (default 1) and `perPage` (default 50) query parameters on 16 collection
    operations, documented as a project convention at
    https://woodpecker-ci.org/docs/development/openapi. Responses are bare arrays with no
    total or link envelope.
- id: idempotency
  conforms: false
  evidence: >-
    No Idempotency-Key header, no idempotency documentation, zero occurrences of
    "idempoten" in the published spec.
- id: oauth2
  conforms: false
  evidence: >-
    OAuth2 is used to sign a HUMAN into the Woodpecker web UI via the configured forge.
    The REST API itself takes a personal access token bearer header and declares no
    oauth2 securityDefinition, so there is no scope surface for an API client.
- id: oidc
  conforms: false
  evidence: /.well-known/openid-configuration is not served on any Woodpecker host (probed 2026-08-27).
- id: sse
  conforms: true
  evidence: >-
    GET /stream/events and GET /stream/logs/{repo_id}/{pipeline}/{step_id} are
    Server-Sent Event streams declared in the Swagger document under the Events and
    Pipeline logs tags.
- id: semver
  conforms: true
  evidence: >-
    Releases follow MAJOR.MINOR.PATCH with release candidates (v3.18.0, v3.14.0-rc.2),
    and the deprecation policy is expressed in terms of the semver cycle.
- id: rfc8594
  conforms: false
  evidence: >-
    No Sunset or Deprecation response headers. Deprecations are published on
    https://woodpecker-ci.org/migrations and enforced by the linter instead.
- id: prometheus
  conforms: true
  evidence: >-
    The server exposes a Prometheus text-exposition `/metrics` endpoint, documented at
    https://woodpecker-ci.org/docs/administration/configuration/server: "Woodpecker is
    compatible with Prometheus and exposes a /metrics endpoint if the environment variable
    WOODPECKER_PROMETHEUS_AUTH_TOKEN is set", scraped with that token as a bearer. The docs
    publish the Woodpecker-specific metric names (woodpecker_pipeline_count,
    woodpecker_pipeline_time and others). It is OFF by default and token-gated, which is why
    https://ci.woodpecker-ci.org/metrics returned 404 when probed on 2026-08-27 — an
    operator opt-in, not an absence.
  note: >-
    The /metrics endpoint is NOT described in the Swagger document; it is documented only in
    prose in the server configuration reference.
domain_standards:
- id: cctray
  name: CCTray / CruiseControl cc.xml project status format
  conforms: true
  market: continuous integration
  evidence: >-
    GET /badges/{repo_id}/cc.xml — "Provide pipeline status information to the CCMenu
    tool" — declared in openapi/woodpecker-ci-server-swagger.json under the Badges tag,
    produces text/xml. This is the long-standing de-facto CI build-status feed consumed
    by CCMenu, CCTray and build-light hardware, so an existing CI dashboard integrates
    with Woodpecker with no bespoke connector.
  spec_location: 'paths./badges/{repo_id}/cc.xml.get'
- id: cdevents
  name: CDEvents (Continuous Delivery Foundation)
  conforms: false
  evidence: >-
    No CDEvents emission. The event surface is a proprietary SSE stream at /stream/events;
    no CloudEvents envelope and no CDEvents subject/predicate types appear in the spec or
    the docs.
certifications:
  published: []
  note: >-
    Woodpecker publishes no SOC 2, ISO 27001, PCI, HIPAA or FedRAMP attestation, and no
    trust center. That is expected — it is self-hosted Apache-2.0 software with no
    operated service to certify. Recorded as an honest absence; no Compliance or
    TrustCenter pointer is emitted.