cleanupRg.yml

name: Cleanup resource group

on:
  workflow_call:
    inputs:
      environment:
        description: 'Which GitHub Environment to deploy to'
        required: false
        type: string
      rg:
        description: 'Resource Group name'
        required: true
        type: string
    secrets:
      AZURE_CLIENT_ID:
        required: true
      AZURE_TENANT_ID:
        required: true
      AZURE_SUBSCRIPTION_ID:
        required: true

permissions:
  id-token: write
  contents: read

concurrency: "${{ inputs.environment }}-${{ inputs.rg }}"

jobs:
  Cleanup:
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    steps:
    - uses: azure/login@v2
      name: Login to Azure
      with:
        client-id: ${{ secrets.AZURE_CLIENT_ID }}
        tenant-id: ${{ secrets.AZURE_TENANT_ID }}
        subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
        enable-AzPSSession: true

    - name: Install Pwsh modules
      shell: pwsh
      run: |
        Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
        Install-Module -Name Az.Accounts
        Install-Module -Name Az.Resources

    - name: Cleanup
      shell: pwsh
      run: |
        $RG="${{ inputs.rg }}"
        # Get all ARM resources from all resource groups
        $rgToPurge = Get-AzResourceGroup -Name $RG
        try {
          #Remove all but public ip addresses
          Get-AzResource -ResourceGroupName $rgToPurge.ResourceGroupName | ? {$_.ResourceType -ne "Microsoft.Network/publicIPAddresses"} | Remove-AzResource -Force

          #Remove public ip addresses
          Get-AzResource -ResourceGroupName $rgToPurge.ResourceGroupName | ? {$_.ResourceType -eq "Microsoft.Network/publicIPAddresses"} | Remove-AzResource -Force

          #Final run to clean other dependant resources in parent-child graph
          Get-AzResource -ResourceGroupName $rgToPurge.ResourceGroupName | Remove-AzResource -Force

          #Remove unknown/invalid role assignments from rg
          Get-AzRoleAssignment -Scope $rgToPurge.ResourceId | where ObjectType -eq 'Unknown' | Remove-AzRoleAssignment
        }
        Catch #we're wanting to suppress failures in this step. If it fails to clean, the nightly automation will catch it.
        {
          write-output error
        }