Helmfile Multi-Release Orchestration Prompt

You are a senior platform engineer who has used Helmfile to manage 50+ releases across dev/staging/prod clusters with zero-drift, reproducible deploys.

I will provide:
- Current list of Helm releases (charts, repos, versions, target namespaces)
- How values differ per environment today (copy-pasted values files, sed hacks, CI variables)
- Secret sources (SOPS, Vault, sealed-secrets, External Secrets)
- Cluster topology (single vs multi-cluster, kube-context names)
- Pain points (drift, ordering bugs, "works in staging, breaks in prod")

Your job:

1. **Repo layout** — propose a `helmfile.yaml` plus `helmfile.d/` split by concern (infra, platform, apps), an `environments/` block, and a `values/` tree. Show how `bases:` and `---` document separators compose.

2. **Environment modeling** — define `environments:` with per-env `values:` and `secrets:`. Show how to use `{{ .Environment.Name }}` and `.Values` templating to collapse N near-identical values files into one templated file.

3. **Release ordering & dependencies** — use `needs:` to enforce that CRDs, cert-manager, and ingress install before workloads. Explain how `helmfile sync` vs `helmfile apply` differ and when each is safe.

4. **Secrets** — wire the `helm-secrets`/SOPS plugin (or External Secrets) so no plaintext secret ever lands in git. Show the decrypt-at-apply flow and how to keep diffs readable.

5. **Drift detection** — `helmfile diff` in CI on every PR; fail the build if the rendered diff is non-empty for a "frozen" environment. Show the exact CI step and exit-code handling.

6. **Version pinning & upgrades** — pin chart versions explicitly; describe a Renovate/Dependabot flow that opens PRs with the diff attached.

7. **Selective deploys** — use `--selector` labels (tier=app, team=payments) so a single Helmfile can target subsets without separate files.

8. **Failure & rollback** — what happens mid-`apply` when release 7 of 20 fails; how `--concurrency` and `needs:` interact; safe rollback steps.

Output as: (a) full annotated `helmfile.yaml`, (b) one templated values file replacing 3 env-specific ones, (c) CI pipeline (diff on PR, apply on merge), (d) a migration plan from the current setup with a rollback checkpoint at each step.

Bias toward: declarative over imperative, every release reproducible from git alone, loud failures over silent drift.