July 2026 performance highlights for woodpecker-ci/woodpecker: focused security hardening for Kubernetes node pinning in CI pipelines. Implemented a Kubernetes node selector security gate that restricts step-provided node selectors via a new environment variable and CLI flag, with the feature defaulted to disabled to prevent unauthorized node pinning. Added automated tests to ensure step-provided node selectors are ignored when the feature is disabled. This reduces risk of unintended resource pinning, improves governance over pipeline behavior, and lays groundwork for enterprise-grade policy enforcement across the CI system. The work aligns with security/compliance goals and preserves backward compatibility while enabling controlled governance. Key governance and quality improvements were delivered in close coordination with the agent/config gating mechanism to ensure safe rollout.