Push code.
Hands off the wheel.
Helmsman writes the Dockerfile and the manifests, has an AI review the blast radius, and commits. Then it watches the rollout — and reverts itself if the pods don't come up.
$ ./bin/pipeline -app-repo . -app checkout-api -env staging \ -image ghcr.io/acme/checkout-api:sha-9f3c1b == 1/4 detect == language=node framework=express entrypoint="npm start" port=4000 confidence=high == 2/4 containerize == wrote ./Dockerfile (multi-stage, non-root) == 3/4 generate manifests == deployment.yaml, service.yaml, ingress.yaml, kustomization.yaml replicas=3 cpu=150m/750m mem=192Mi/768Mi public=true == 4/4 risk review + commit == static: 0 findings ai: 0 findings score=4/100 approved committed a41f0c8 to gitops-repo:apps/checkout-api/staging ArgoCD reconciles the commit. health-watcher takes it from here.
The pipeline
Six stages.
Two of them ask an AI anything.
Detection, containerization and manifest generation are deterministic and template-driven, because they are solved problems — a probabilistic answer there is strictly worse than a correct one.
The design decision
The interesting part is
how little of this is AI.
Most of the pipeline is boring on purpose. "AI-generated YAML" fails by being subtly invalid or inconsistent between runs, so that failure mode is designed out rather than reviewed for.
Deterministic
No model call- Language & framework detection
- Marker files and dependency manifests. Node, Python, Go, Java, Ruby, Rust — with the port read from your source when it's explicit.
- Dockerfile generation
- Per-language templates: multi-stage where it helps, non-root everywhere, exec-form CMD so SIGTERM actually reaches your process.
- Kubernetes manifests
- Identical bytes for identical input, so the GitOps diff stays reviewable.
- Health evaluation
- "Is this pod crash-looping" is not a judgment call.
AI-assisted
Gemini · fails closed- Risk review of the diff
- Layered on top of static policy checks — an env var that looks like a plaintext secret, a resource shape that doesn't match the workload, a diff that changes more than a routine deploy should.
- Root-cause analysis
- Pod statuses and cluster events turned into a plain-English explanation and one concrete next step.
- Additive, never subtractive
- An AI finding can raise the risk score. It can never clear a static finding or lower the score below it.
- No key, no problem
- Without
GEMINI_API_KEYthe review runs static-only and says so. It never silently passes as "reviewed".
What ships
Seven binaries.
No dependencies.
There is no platform server to run. Helmsman is CLIs that run in your app repos' CI, plus one CronJob in your cluster. The Go module has an empty require block — the whole supply chain is the standard library.
- pipeline
- Runs detect → containerize → manifest → commit end to end. The one command most repos ever call.
- risk-reviewer AI
- The PR gate. Exits non-zero when the risk score crosses the threshold, so branch protection can block the merge.
- health-watcher AI
- Runs in-cluster as a CronJob or ArgoCD PostSync hook. Watches the rollout, explains failures, reverts the commit.
- detector
- Language, framework, build tool, entrypoint and port — from the working tree, with no configuration.
- containerizer
- A production-minded Dockerfile per language, and a
.dockerignorethat keeps your.envout of the image. - manifest-generator
- Deployment, Service, Ingress and Kustomization, with probes, limits and a locked-down security context.
- gitops-writer
- Writes and commits to the GitOps repo, renders the ArgoCD
Application, and performs reverts for rollback. - platform.yaml
- Optional per-app overrides — replicas, resources, env vars, secret references, public exposure. Every field has a safe default.
Get started
No cluster. No API key.
About a minute.
The full pipeline runs locally against a throwaway GitOps repo, so you can read the commit it produces before pointing it at anything real.
Clone and build
Go 1.25 or newer. Nothing else to install.
git clone https://github.com/zishaan1911/Helmsman.git cd Helmsman/gitops-ai-platform make binaries
Run it against the bundled example
One target creates a scratch GitOps repo, runs all four stages, and shows you the commit.
make demo
Point it at your own service
Any repo with a package.json, go.mod, requirements.txt, pom.xml, Gemfile or Cargo.toml.
./bin/pipeline \ -app-repo ../my-service \ -gitops-repo /tmp/gitops-repo \ -app my-service \ -image ghcr.io/acme/my-service:sha-9f3c1b \ -env staging \ -gitops-repo-url https://github.com/acme/gitops-repo.git
Tune it, if you want to
Drop a platform.yaml next to your code. Every field is optional.
port: 4000 replicas: 3 public: true resources: cpuRequest: "150m" memoryRequest: "192Mi" cpuLimit: "750m" memoryLimit: "768Mi" env: - name: LOG_LEVEL, value: info - name: DATABASE_URL, secretRef: my-service-secrets/database-url
The rules it plays by
Nothing here can
surprise your cluster.
It never mutates the cluster
No kubectl apply, no API writes, no cluster credentials in CI. Helmsman writes files and makes commits; ArgoCD or Flux does the rest, unmodified.
Rollback is a revert, not a reset
The bad deploy stays in history, so the incident is still reconstructable afterwards. And the rollback goes through ArgoCD like any other change.
Re-running changes nothing
Identical input produces byte-identical manifests, and an unchanged run makes no commit. Your GitOps history stays a record of real changes.
Secrets stay in Kubernetes
secretRef renders as a secretKeyRef — never an inline value. Secret material never enters a manifest, a commit, or an AI prompt.
Zero third-party dependencies
The module's require block is empty. Nothing between your deploy repo and the Go standard library.
Gated by the rules you already have
The output is a pull request against a Git repo. Whatever branch protection, CODEOWNERS and review policy you run applies unchanged.
Push code.
Helmsman holds the course.
Available now. MIT licensed.
docker pull ghcr.io/zishaan1911/helmsman:v1.0.0