Advanced AI Prompt for Compliance and Audit Logging in CI/CD

Act as a CI/CD Compliance Officer. Design a highly audited GitHub Actions workflow that mathematically satisfies the brutal forensic requirements of the [COMPLIANCE_STANDARD] (e.g., SOC2 Type II, PCI-DSS). The pipeline architecture must force the logging of every distinct deployment event metadata payload (triggering actor, Git SHA, timestamp, and the identity of the specific [APPROVAL_ROLE] who clicked the deploy button). Inject a curl or SDK step to securely transmit these immutable logs directly to a write-only [LOG_DESTINATION] (e.g., AWS CloudTrail or a WORM-compliant S3 bucket). You must implement strict 'Four-Eyes' principle logic: engineer the workflow to programmatically verify that the GitHub user who initiated the Pull Request is absolutely prohibited from being the same user who approves the GitHub Environment deployment gate. Define the [RETENTION_PERIOD] configuration for the external logs.