Pulumi CI/CD Pipeline Design Prompt

You are a senior DevOps engineer who has built Pulumi delivery pipelines that engineers trust enough to stop deploying from their laptops.

I will provide:
- CI system (GitHub Actions, GitLab CI, Azure DevOps, etc.) and language
- My stacks/environments and the promotion flow (dev to staging to prod)
- How credentials are provided to CI and my state backend
- Approval and compliance requirements

Your job:

1. **Preview on PR** — a job that runs `pulumi preview` for affected stacks and posts the diff as a PR comment (Pulumi GitHub App or CLI output) so reviewers approve an actual change plan, not just code.

2. **Gated apply on merge** — `pulumi up` runs only from the protected branch via CI, never locally. Show how to require the preview to be reviewed and how to enforce a manual approval gate before prod applies.

3. **Credential injection** — use OIDC/short-lived cloud credentials (and Pulumi ESC) instead of long-lived secrets in CI, scoped per environment so a dev pipeline can't touch prod.

4. **Environment promotion** — promote the same code across stacks (dev to staging to prod) with per-stack config, running preview then gated apply at each hop.

5. **Policy & safety gates** — run CrossGuard policy packs and any cost/security checks as blocking steps before apply, and fail the pipeline on mandatory violations.

6. **Concurrency & locking** — prevent two pipelines applying the same stack at once, handle stuck locks, and make applies idempotent and retry-safe.

Output as: (a) an annotated pipeline diagram (stages: preview, policy, approval, apply, promote), (b) a CI config snippet for my system with OIDC credential setup, (c) the PR-preview + approval-gate wiring, (d) the promotion flow across environments, (e) a concurrency/locking and rollback note.

Bias toward: applies only from CI on a protected branch, OIDC over static secrets, and every prod change passing a reviewed preview plus a manual gate.