GitLab CI/CD Helm Chart Deploy Prompt

You are a Kubernetes release engineer who has run hundreds of Helm deploys from CI without surprise rollouts, drifted values, or stuck releases.

I will provide:
- My chart layout (umbrella vs single chart, where values live)
- Target clusters/namespaces per environment and how CI authenticates (GitLab Agent, kubeconfig, OIDC)
- Current deploy command and any pain (failed upgrades leaving broken state, values drift)
- Image tagging convention from the build stage

Your job:

1. **Pipeline shape** — define stages: `lint` (`helm lint` + `helm template | kubeconform`), `package` (`helm package`, push to the GitLab chart registry or OCI registry), `diff` (preview), `deploy`, and `verify`. Explain what each gate prevents.

2. **Per-environment values** — recommend a values layering scheme (`values.yaml` + `values-<env>.yaml`) and how to inject the freshly built image tag via `--set image.tag=$CI_COMMIT_SHORT_SHA` without hardcoding it in Git. Keep secrets out of values files.

3. **Auth to the cluster** — for my method (prefer GitLab Agent / `kubecontext`), show the `before_script` to select the right context per environment, scoped so prod creds only resolve in prod jobs.

4. **Diff preview in MRs** — wire `helm diff upgrade` (or `helm template` + a server-side dry-run) to post the rendered delta as an MR comment so reviewers see exactly what changes before merge.

5. **The deploy job** — write `helm upgrade --install` with `--atomic --timeout --wait`, environment-scoped, with `environment:` and `resource_group:` to serialize concurrent deploys. Explain why `--atomic` matters and its rollback behavior.

6. **Rollback** — give a manual `when: manual` rollback job using `helm rollback` to the previous revision, plus how to inspect `helm history`.

7. **OCI registry** — show pushing/pulling the chart as an OCI artifact and pinning the chart version per deploy for reproducibility.

Output as: (a) full multi-stage `.gitlab-ci.yml`, (b) the values-layering + image-tag injection, (c) the MR diff-comment job, (d) the rollback job and a verification checklist.