CircleCI cost vs self-hosted Woodpecker CI and Jenkins

Woodpecker CI is licensed under Apache-2.0 and Jenkins is distributed under the MIT License, so neither project charges a software license fee. CircleCI and CircleCI Server are commercial products, so their license or plan costs recur and are set by the vendor. For the cost comparison, the license line is the one place where the two open-source options are clearly cheaper, but it only removes one component. Your finance team should record that the software line for Woodpecker and Jenkins is zero and then move the budget to the components that still cost money: build servers, storage, upgrades, support and staff time.

Licensing risk deserves a place in the same comparison. Woodpecker exists because Drone 0.8 was forked in 2019 after Drone moved from Apache 2.0 to a proprietary license. Drone is now managed by Harness under the Polyform Small Business license. The lesson is not that Woodpecker will change in the same way, but that a permissive license is a property of the release you run, and the terms of a future release can differ. Ask legal to confirm the license of the exact Woodpecker and Jenkins versions you deploy, record the license files in your software bill of materials, and check whether any plugins you depend on carry different terms.

A free license does not mean free operation. Someone must install, patch, back up and monitor the platform, and that effort is paid for in staff time or a partner contract. A commercial support agreement for either project is a separate purchase, and it is optional. If you want one, request it in writing with the named products and versions, response commitments, included upgrade assistance, and what is excluded. Do not assume that a support contract is priced like a CircleCI plan, and do not count it in the cost model until a written quote exists.

Plan the one-time work before any build server is sized, because the largest move cost in this section is not infrastructure but re-creating secrets. CircleCI states that environment variable values are not readable in its app after they are set, so the values cannot be exported. Each secret has to be re-created from its source system, such as a cloud account, a registry or a signing key, and every one of them should then be rotated as part of the cutover. Ask your team to inventory every project and context that holds credentials, note which ones are used by deploy jobs, and decide who owns each value in the new Woodpecker or Jenkins credential store. The inventory is effort that recurs in no subscription line, so it belongs in the one-time budget and in the scope agreed with any implementation partner.

Build history is the second one-time item. CircleCI sets 30 days as both the default and the maximum artifact retention, according to its artifacts documentation, so anything you need for audit, release traceability or rollback must be downloaded before the window closes. Export test results, release bundles and signed images while the account is still active, and record where each file is stored in the new environment. Confirm with your compliance lead how long those records must be kept, since that retention period, not CircleCI's, will govern the new storage you provision.

Rotation is not optional housekeeping. CircleCI told all customers to rotate secrets after its January 4, 2023 incident, in which an attacker exfiltrated customer environment variables, tokens and keys along with the encryption keys needed to read them. Treat that precedent as a reason to put rotation in the budget for any hosted CI service you leave, and schedule it as a step in the cutover plan rather than a follow-up. Woodpecker can connect to the same GitHub, GitLab or Bitbucket repositories, so the repositories themselves do not need to move, which keeps this work focused on pipelines, credentials and history.

A fixed-scope quote for moving off CircleCI should state its scope in units you can count and compare. Ask every bidder, whether a DeployOpen engagement, another partner or your own team's estimate, for the pipeline inventory: how many CircleCI projects, workflows and jobs are in scope, which ones use orbs, contexts and custom images, and which are retired rather than migrated. Next, ask for the environments covered (development, staging, production and any air-gapped network), the number of build agents or Woodpecker agents and Jenkins build agents planned per environment, and the autoscaling approach if any. Each of these is a line item that changes the total, so a quote that lists only a total price cannot be checked.

The storage, retention and secret items are where migrations most often go wrong. Ask for the artifact and log retention target in writing, since CircleCI keeps artifacts for 30 days, and confirm who exports existing build history before the window closes. Ask who re-creates each environment variable and context value in the new system, because CircleCI does not display stored values, and whether the quote includes rotating every credential that a connected project used. Also request a parallel-run period with a stated exit test, the upgrade and backup runbooks for the new platform (for Jenkins, the contents of $JENKINS_HOME and the controller backup routine), and the training and handover sessions with named deliverables. Compare the bids line by line on these items, and treat any item left out as a cost you will still carry.