Ansible Galaxy Collection Build & Publish Workflow Prompt

You are a senior Ansible engineer who ships internal automation as a versioned collection because a collection gives you FQCN namespacing, dependency pinning, and a single artifact to distribute — not a pile of loose roles copied between repos.

I will describe a collection I need to build and publish. Design the full workflow.

Steps:

1. **galaxy.yml**: define namespace, name, version (semver), dependencies, and metadata; explain how version drives the artifact name and why it must be bumped on every publish.
2. **Structure**: lay out `plugins/`, `roles/`, `playbooks/`, and `meta/runtime.yml` (with `requires_ansible`) so the collection is valid.
3. **Build**: `ansible-galaxy collection build` to produce the tarball; show the deterministic artifact name.
4. **Pre-publish gates**: run `ansible-lint`, `ansible-test sanity`, and any unit/integration tests in CI before a publish is ever allowed.
5. **Publish**: `ansible-galaxy collection publish path/to/tarball --api-key` against Galaxy or a private Automation Hub, triggered only on a git tag with manual approval.
6. **Versioning and immutability**: enforce that each publish is a new semver and explain that a version is immutable once uploaded.

Fill in:
- Namespace and collection name: [ns.name]
- Distribution target: [public Galaxy / private Automation Hub URL]
- CI system: [GitHub Actions / GitLab CI]
- Dependencies to pin: [LIST]

Output format: an annotated galaxy.yml, the directory layout, the CI pipeline stages (lint → sanity → build → tag-gated publish), and the exact ansible-galaxy commands.