ci: cleanup azure ci resources

.github/workflows/cleanup-azure-ci-resources.yml

@@ -0,0 +1,27 @@
+name: cleanup azure ci resources
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '15 4 * * 4' # At 04:15 on Thursday.
+  pull_request:
+    paths:
+      - .github/workflows/cleanup-azure-ci-resources.yml
+      - packages/by-name/azure-ci-rg-cleanup
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ./.github/actions/setup_nix
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          cachixToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      - name: Login to Azure
+        uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
+        with:
+          creds: ${{ secrets.CONTRAST_CI_INFRA_AZURE }}
+      - name: Cleanup Azure CI resources
+        run: |
+          nix run .#azure-ci-rg-cleanup

packages/by-name/azure-ci-rg-cleanup/cleanup.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Copyright 2025 Edgeless Systems GmbH
+# SPDX-License-Identifier: AGPL-3.0-only
+
+set -euo pipefail
+
+declare -a resources
+
+keepResources=(
+  "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/contrast-ci/providers/Microsoft.ContainerService/managedClusters/contrast-ci"
+  "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/contrast-ci/providers/Microsoft.Compute/galleries/contrast_ci_contrast"
+  "/subscriptions/0d202bbb-4fa7-4af8-8125-58c269a05435/resourceGroups/contrast-ci/providers/Microsoft.Compute/galleries/contrast_ci_contrast/images/contrast"
+)
+
+while IFS= read -r resourceID; do
+  for keepResource in "${keepResources[@]}"; do
+    if [[ $resourceID == "$keepResource" ]]; then
+      continue 2
+    fi
+  done
+  resources+=("$resourceID")
+done < <(
+  az resource list --resource-group contrast-ci -o json |
+    jq -r '
+            .[]
+            | select(
+                .createdTime and (
+                    .createdTime
+                    | sub("\\.[0-9]+\\+00:00$"; "Z")
+                    | fromdateiso8601 < (now - 604800)
+                )
+            )
+            | .id'
+)
+
+# Sort resource IDs for better readability
+mapfile -t resources < <(printf '%s\n' "${resources[@]}" | sort)
+
+echo Found ${#resources[@]} resources to delete
+
+exitcode=0
+for resource in "${resources[@]}"; do
+  exitSingle=0
+  echo "Deleting resource $resource"
+  az resource delete --ids "$resource" || exitSingle=$?
+  if [[ $exitSingle -ne 0 ]]; then
+    echo "Error: failed to delete resource $resource"
+    exitcode=1
+  fi
+done
+
+exit $exitcode

packages/by-name/azure-ci-rg-cleanup/package.nix

@@ -0,0 +1,13 @@
+# Copyright 2025 Edgeless Systems GmbH
+# SPDX-License-Identifier: AGPL-3.0-only
+
+{
+  writeShellApplication,
+  azure-cli,
+}:
+
+writeShellApplication {
+  name = "azure-ci-rg-cleanup";
+  runtimeInputs = [ azure-cli ];
+  text = builtins.readFile ./cleanup.sh;
+}