🛤️ Golden Path

Opinionated service scaffolder that generates production-ready repos (Go/TS), with CI/CD, Helm, GitOps, OpenTelemetry, and security defaults baked in.

---

30-Second Demo

# Install
go install github.com/allemeshov/golden-path/cmd/goldenpath@latest

# Generate a Go API service
goldenpath new service orders --stack go --mode api

# Validate the generated repo
cd orders && goldenpath validate

What You Get

Every generated service includes:

• HTTP API — Go (chi) or TypeScript (Fastify) with /healthz, /readyz, /metrics
• OpenTelemetry — Traces (OTLP) + metrics (Prometheus) + structured logging
• Dockerfile — Multi-stage, distroless/slim base, non-root user
• Helm Chart — Deployment, Service, HPA, ServiceMonitor, NetworkPolicy, PrometheusRule
• GitOps — Argo CD Application manifests per environment
• CI Pipeline — GitHub Actions: lint, test, build, SBOM, container scan, Helm lint, policy checks
• Security Defaults — Non-root containers, read-only FS, seccomp, resource limits, capabilities dropped
• Dependency Management — Renovate config with auto-merge for patches
• Governance Files — CODEOWNERS, SECURITY.md, LICENSE

Installation

Go Install

go install github.com/allemeshov/golden-path/cmd/goldenpath@latest

From Source

git clone https://github.com/allemeshov/golden-path.git
cd golden-path
make build
./bin/goldenpath version

Binary Releases

Download from GitHub Releases.

Usage

Generate a Service

# Go API
goldenpath new service orders --stack go --mode api --port 8080

# TypeScript API
goldenpath new service payments --stack ts --mode api --port 3000

# Custom output directory
goldenpath new service orders --stack go --mode api --output ./services/orders

Interactive Wizard

goldenpath init

Walks you through: service name, language, type, port, owner, and deployment environments.

Validate a Repo

# Validate current directory
goldenpath validate

# Validate specific path
goldenpath validate --path ./my-service

Checks: required files, Dockerfile security, Helm best practices, OTel presence, CI pipeline existence.

List Templates

goldenpath templates list

Version

goldenpath version

Generated Repo Structure

orders/
├── cmd/orders/main.go              # Application entry point
├── internal/
│   ├── server/server.go            # HTTP routes + middleware
│   └── observability/otel.go       # OTel setup
├── helm/orders/
│   ├── Chart.yaml
│   ├── values.yaml
│   └── templates/
│       ├── deployment.yaml          # With security context + probes + resources
│       ├── service.yaml
│       ├── servicemonitor.yaml
│       ├── hpa.yaml
│       ├── networkpolicy.yaml
│       └── prometheusrule.yaml      # Default alerts
├── gitops/argocd/
│   └── application.yaml             # Per-environment Argo CD apps
├── .github/workflows/ci.yml         # Full CI pipeline
├── Dockerfile                        # Multi-stage, distroless, non-root
├── Makefile
├── go.mod
├── goldenpath.yaml                   # Service contract
├── renovate.json
├── CODEOWNERS
├── SECURITY.md
├── LICENSE
└── README.md

Security Defaults

These are baked into every generated service:

Practice	Implementation
Non-root containers	USER nonroot in Dockerfile, runAsNonRoot: true in K8s
Read-only filesystem	readOnlyRootFilesystem: true in security context
Minimal base images	Distroless (Go), slim (Node)
Capabilities dropped	drop: [ALL] in container security context
Seccomp profile	RuntimeDefault
Resource limits	CPU + memory requests/limits in Helm values
Network policies	NetworkPolicy template included
SBOM generation	Syft via GitHub Actions
Image scanning	Trivy in CI pipeline
Dependency updates	Renovate with auto-merge for patches
No plaintext secrets	Only external secret provider references

Template Authoring

See docs/writing-templates.md for how to create custom templates.

Policy Philosophy

Policies enforce structural correctness and security hygiene — not enterprise governance. See docs/policies.md.

Architecture

See docs/architecture.md for the full design.

Roadmap

v0.1 (MVP) ✅

• Go API + TS API templates end-to-end
• GitHub Actions + Helm + Argo CD manifests
• validate command + basic policies
• Release binaries via GoReleaser

v0.2

• Template registry from git ref (goldenpath templates pull)
• PrometheusRule + basic dashboard JSON
• upgrade command (re-render selected modules safely)

v0.3

• Plugin system: goldenpath plugins install
• More stacks: worker, cronjob
• Policy packs (security, compliance-lite)
• Conftest/OPA Rego integration

Non-Goals

• Not a full IDP (Backstage replacement)
• Not a full policy engine (integrate with OPA/Conftest later)
• Not a framework — generates a repo then gets out of the way

Contributing

Contributions are welcome! Please read the Code of Conduct first.

# Development
make lint
make test
make test-golden
make build

License

MIT