Inspiration

We envisioned Zenith AI as a personal chief of staff that brings everyday productivity into one intelligent workspace. Inspired by the potential of AI agents and Google Workspace, we wanted to build an assistant that goes beyond answering questions to understanding intent, coordinating tasks, and executing actions securely. We also wanted to demonstrate how GitLab DevSecOps practices can support the entire software development lifecycle.

What it does

Zenith AI provides a conversational interface for managing Gmail, Google Calendar, Tasks, Drive, and notes. Powered by Gemini, it interprets user intent, decomposes complex requests into actionable steps, selects appropriate tools, and synthesizes contextual responses.

Beyond productivity, the project demonstrates an end-to-end DevSecOps workflow using GitLab CI/CD, covering code quality, automated testing, security scanning, software supply chain security, containerisation, deployment, monitoring, and release automation.

Security is built into the application through Google OAuth with PKCE, JWT-based sessions, redirect allowlists, rate limiting, CORS restrictions, sanitised content rendering, and server-side credential handling.

How we built it

We built the frontend using React, Vite, and TypeScript, with FastAPI powering the backend. Gemini handles intent understanding, task decomposition, tool selection, and response synthesis, while Google Workspace APIs enable productivity integrations.

GitLab CI/CD orchestrates the development lifecycle, including Conventional Commit validation, Python and frontend quality checks, automated tests, API smoke tests, Docker image packaging, SBOM generation, and SAST, dependency, secret, and container scanning. The pipeline also supports Firestore index deployment, cloud deployment configuration, review apps, post-deployment verification, uptime monitoring, rollback workflows, and semantic versioning.

Challenges we ran into

One of our biggest challenges was coordinating multiple tools and services while maintaining reliable, predictable agent behaviour. Integrating Google Workspace APIs required careful authentication, credential management, and permission handling.

Building a comprehensive DevSecOps pipeline introduced another layer of complexity: ensuring that quality checks, security scans, deployment steps, and release workflows worked together without slowing development unnecessarily. We also had to balance flexibility and automation with safeguards against unsafe actions and untrusted content.

Accomplishments that we're proud of

Built a conversational AI productivity assistant that brings multiple Google Workspace services into one interface.
Integrated Gemini into an agentic workflow for intent understanding, task decomposition, tool selection, and response synthesis.
Implemented security-conscious authentication, session management, API protections, and content sanitisation.
Established a comprehensive GitLab CI/CD workflow spanning code validation, automated testing, security scanning, packaging, deployment, and release management.
Connected application development with DevSecOps practices, making security and quality checks part of the development lifecycle rather than an afterthought.

What we learned

We learned that building useful AI agents requires more than connecting an LLM to APIs. Reliable tool orchestration, clear execution boundaries, secure authentication, and meaningful error handling are essential for real-world applications.

We also gained practical experience in integrating security into CI/CD pipelines, automating software quality checks, generating SBOMs, scanning application dependencies and containers, and designing deployment workflows with post-deployment verification and rollback support.

What's next for Zenith AI

Our next steps include improving agent reliability, expanding integrations, and introducing more robust observability and evaluation for multi-step workflows. We aim to strengthen human approval controls for consequential actions, improve automated recovery from tool failures, and enhance deployment reliability.

We also plan to continue refining the GitLab DevSecOps workflow, with better pipeline efficiency, deeper security coverage, and more automated release validation, making Zenith AI a stronger example of secure, AI-powered productivity engineering.