WorkOS
WorkOS is making enterprise-auth infra programmable by agents and embeddable in the browser.
A side-by-side editorial comparison of Woodpecker CI and Depot — release velocity, themes, recent moves, and the top alternatives to consider.
| Feature | Woodpecker CI | Depot |
|---|---|---|
| Sector | Infra & APIs | Infra & APIs |
| Velocity score | 0.0 | 6.3 |
| Sparks · 30d | 0 | 1 |
| Top themes | ci-cd, pipeline, agent-security, forge-integration | build-acceleration, ci-cd, source-control, sherlock-ai |
| Last editorial update | 1mo ago | 13h ago |
| Website | Visit → | — |
Woodpecker CI hardens agent security and forge handling through its 3.14 release candidates
Woodpecker is iterating through 3.14.0 release candidates focused on security and agent/forge robustness: sanitizing agent-introduced state changes and log streaming, blocking registration as arbitrary agents, restricting log access, and cleaning up the Forge interface. Dependency security bumps (axios, otel, follow-redirects) and a lodash removal run throughout.
Depot is expanding from build acceleration into a full dev-infra platform — its own compute metal and now its own git hosting.
Depot is moving fast beyond its build-cache roots. In a matter of weeks it launched Depot Metal (its own bare-metal compute and storage tier, claiming up to 50% faster CI), opened Depot Code (a diskless, S3-backed git hosting service) in private beta, extended Sherlock AI analysis to every workflow and job, and broadened CI plumbing with Tailscale networking, GitLab OIDC, and historical-timing test splitting. The surface is widening from 'make builds fast' to 'run the whole CI and source stack.'
Woodpecker is iterating through 3.14.0 release candidates focused on security and agent/forge robustness: sanitizing agent-introduced state changes and log streaming, blocking registration as arbitrary agents, restricting log access, and cleaning up the Forge interface. Dependency security bumps (axios, otel, follow-redirects) and a lodash removal run throughout.
The 3.14 line reads as a security-and-internals hardening cycle, tightening the agent trust boundary and forge integration rather than pushing features. The earlier 3.11 line shows the more typical mix of per-repo config features and fixes.
Expect 3.14.0 to converge to a stable release after the RC series, continuing the agent-security and forge-handling focus.
Depot is moving fast beyond its build-cache roots. In a matter of weeks it launched Depot Metal (its own bare-metal compute and storage tier, claiming up to 50% faster CI), opened Depot Code (a diskless, S3-backed git hosting service) in private beta, extended Sherlock AI analysis to every workflow and job, and broadened CI plumbing with Tailscale networking, GitLab OIDC, and historical-timing test splitting. The surface is widening from 'make builds fast' to 'run the whole CI and source stack.'
The trajectory is vertical integration: Depot is taking ownership of each layer beneath CI — compute (Metal), networking (Tailscale, OIDC), test intelligence (splitting, Sherlock), and now source control (Code). Owning git hosting is the boldest step, positioning Depot to plug source, compute, and CI into one tightly coupled system rather than accelerating someone else's stack.
Expect Depot Code to progress from private beta toward general availability with tighter Depot CI integration, and Sherlock's AI analysis to expand from diagnosis toward more proactive optimization suggestions.
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Woodpecker CI or Depot.
WorkOS is making enterprise-auth infra programmable by agents and embeddable in the browser.
Merge grinds weekly on the reliability and coverage of its unified API integrations.
Render is turning its PaaS into infrastructure your coding agent can operate directly.
Retool keeps layering enterprise governance and app-workflow wiring onto the new builder.
Semgrep grinds its analysis engine wider — more languages, more taint precision, less noise.
Buildkite is pouring its energy into an agent-native MCP server and broadening CI to GitLab.
See all Woodpecker CI alternatives → · See all Depot alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
Both compete on the same themes — ci-cd — within Infra & APIs. Depot is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Depot is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
Top Woodpecker CI alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Woodpecker CI alternatives" section above for the current picks, or visit /alternatives/woodpecker-ci for the full list with editorial commentary on each.
Top Depot alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Depot alternatives" section above for the current picks, or visit /alternatives/depot for the full list with editorial commentary on each.