How should a team design a comprehensive PHP application deployment pipeline that incorporates automated testing, security scanning, and staged rollouts across multiple environments?

A comprehensive deployment pipeline typically runs automated tests and static analysis tools on every code change, scans dependencies for known security vulnerabilities before allowing a deployment to proceed, deploys automatically to a staging environment for further manual or automated verification, and then promotes the exact same tested build artifact to production using a controlled process such as a canary or blue green deployment strategy, all orchestrated through a continuous integration and continuous delivery tool to ensure consistency and reduce the risk of human error at every stage of the release process.

// Simplified pipeline stages
// 1. Run PHPUnit tests and PHPStan analysis
// 2. composer audit for vulnerable dependencies
// 3. Deploy to staging, run smoke tests
// 4. Promote identical build to production