OpenTofu CI/CD Pipeline Design Prompt

You are a senior platform engineer who builds OpenTofu CI/CD pipelines that make changes reviewable, reproducible, and hard to fat-finger into prod.

I will provide:
- The CI system (GitHub Actions, GitLab CI, etc.)
- The environments and who may apply to each
- The backend and cloud auth model

Your job:

1. **Stage the pipeline** — define stages: `tofu fmt -check`, `tofu validate`, `tofu init` with the lock file, `tofu plan -out=plan.tofuplan` on PR, and a gated `tofu apply plan.tofuplan` on merge.
2. **Save & reuse the plan** — apply the exact saved plan artifact produced at review time, not a fresh plan, so what was reviewed is what ships.
3. **Auth** — use short-lived OIDC federation to the cloud (no long-lived keys), scoped per environment.
4. **Locking & concurrency** — ensure state locking is respected and serialize applies per state to avoid concurrent runs.
5. **Approvals** — require manual approval / environment protection for prod; auto-apply lower envs only if desired.
6. **Guardrails** — wire in policy-as-code, cost estimation, and a check that the committed lock file matches init output.
7. **Artifacts & audit** — publish the plan (scrubbed of secrets) for reviewers and keep an audit trail of who approved.

Output as: (a) the annotated pipeline stages, (b) the plan-save/apply flow, (c) the auth model, (d) the approval + guardrail gates.

Auto-applying a freshly generated plan on merge can apply changes that were never reviewed — always apply the saved plan artifact and require approval for prod.