Pepo48 · Nov 6, 2026
@@ -18,7 +18,10 @@ IMAGE="Ubuntu2404"
 
 if [[ "$ACTION" == "create" ]]; then
   # 1. Resource group
-  az group create --name "$CLUSTER" --location "$REGION"
+  GROUP_EXISTS=$(az group exists --name "$CLUSTER")
+  if [[ "$GROUP_EXISTS" == "false" ]]; then
+    az group create --name "$CLUSTER" --location "$REGION"
+  fi
 
   # 2. SSH key
   if [[ ! -f "${SSH_KEY}" ]]; then

@@ -14,7 +14,12 @@ requiredEnv AZURE_SUBSCRIPTION AZURE_ADMIN_USER AZURE_DB_USER
 
 # Resource group (created via idempotent command)
 echo "Creating resource group ${AZURE_RG} in ${AZURE_REGION}"
-az group create --name ${AZURE_RG} --location ${AZURE_REGION} --subscription ${AZURE_SUBSCRIPTION}
+group_args=(--name "$AZURE_RG" --location "$AZURE_REGION" --subscription "$AZURE_SUBSCRIPTION")
+if [[ "${GITHUB_ACTIONS:-}" == "true" ]]; then
+  group_args+=(--tags "keycloak-ci-repository=$GITHUB_REPOSITORY" "keycloak-ci-run=$GITHUB_RUN_ID"
+    "keycloak-ci-attempt=$GITHUB_RUN_ATTEMPT")
+fi
+az group create "${group_args[@]}"
 
 echo "Creating SQL server ${AZURE_NAME}-sqlsrv"
 az sql server create \

@@ -0,0 +1,67 @@
+name: Azure Delete
+
+on:
+  workflow_run:
+    workflows: [Keycloak CI]
+    types: [completed]
+
+permissions:
+  actions: read
+
+jobs:
+  delete:
+    name: Delete Azure resource group
+    if: >-
+      github.event.workflow_run.head_repository.full_name == github.repository &&
+      (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'workflow_dispatch')
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      CI_RUN_ID: ${{ github.event.workflow_run.id }}
+      CI_RUN_ATTEMPT: ${{ github.event.workflow_run.run_attempt }}
+    steps:
+      - name: Check whether Azure provisioning could have started
+        id: azure-job
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HAS_AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS != '' }}
+        run: |
+          if [[ "$HAS_AZURE_CREDENTIALS" != "true" ]]; then
+            exit 0
+          fi
+
+          azure_job=$(gh api --paginate \
+            "repos/$GITHUB_REPOSITORY/actions/runs/$CI_RUN_ID/attempts/$CI_RUN_ATTEMPT/jobs?per_page=100" \
+            --jq '.jobs[] | select(.name == "AzureDB IT" and .conclusion != "skipped") | .id')
+          if [[ -n "$azure_job" ]]; then
+            echo "ran=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Login to Azure
+        if: steps.azure-job.outputs.ran == 'true'
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Delete and verify resource group
+        if: steps.azure-job.outputs.ran == 'true'
+        run: |
+          groups=$(az group list --query \
+            "[?tags.\"keycloak-ci-repository\"=='$GITHUB_REPOSITORY' && tags.\"keycloak-ci-run\"=='$CI_RUN_ID' && tags.\"keycloak-ci-attempt\"=='$CI_RUN_ATTEMPT'].[name, properties.provisioningState]" \
+            --output tsv)
+          if [[ -z "$groups" ]]; then
+            echo "No Azure resource group found for this CI attempt."
+            exit 0
+          fi
+
+          read -r group state <<< "$groups"
+          expected_name="^gh-action-[0-9a-f]+-${CI_RUN_ID}-${CI_RUN_ATTEMPT}$"
+          if [[ "$groups" == *$'\n'* || ! "$group" =~ $expected_name ]]; then
+            echo "::error::Expected one CI resource group with a name matching the triggering attempt."
+            exit 1
+          fi
+
+          if [[ "$state" != "Deleting" ]]; then
+            az group delete --name "$group" --yes --no-wait
+          fi
+          az group wait --name "$group" --deleted --timeout 1500
@@ -701,7 +701,8 @@ jobs:
 
         env:
           AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
-      - name: Login to Azure
+      - id: azure-login
+            name: Login to Azure
         uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
@@ -828,7 +829,7 @@ jobs:
           path: .github/scripts/ansible/files
 
       - name: Delete all Azure resources (resource group)
-        if: always()
+        if: always() && steps.azure-login.outcome == 'success'
         working-directory: .github/scripts/ansible
         run: |
           ./azure_vm_manager.sh delete ${{ steps.azure-init.outputs.region }} ${{ steps.azure-init.outputs.azure-cluster-name }}