cleanup.yml

jobs:
- job: DeleteResourceGroup
  displayName: 'Delete resource group'
  pool:
    name: '$(SharedLinuxPool)'
    vmImage: '$(LinuxVmImage)'
  steps:
  - task: AzurePowerShell@5
    displayName: 'Delete resource group'
    inputs:
      azureSubscription: $(ConnectedServiceName)
      azurePowerShellVersion: latestVersion
      ScriptType: InlineScript
      Inline: |
        $deploymentEnvName = "$(DeploymentEnvironmentName)"
        $keyVaultBaseName = "$(KeyVaultBaseName)"
        
        Get-AzResourceGroup -Name $(UniqueResourceGroupName) -ErrorVariable notPresent -ErrorAction SilentlyContinue 
        if ($notPresent) {
          Write-Host "Resource group $(UniqueResourceGroupName) not found"
        } else {
          Write-Host "Deleting resource group $(UniqueResourceGroupName)"
          $maxRetries = 3
          $retryCount = 0
          $deleted = $false
          
          while (-not $deleted -and $retryCount -lt $maxRetries) {
            try {
              Remove-AzResourceGroup -Name $(UniqueResourceGroupName) -Force -Verbose -ErrorAction Stop
              $deleted = $true
              Write-Host "Successfully deleted resource group $(UniqueResourceGroupName)"
            }
            catch {
              $retryCount++
              if ($retryCount -lt $maxRetries) {
                Write-Warning "Failed to delete resource group (attempt $retryCount of $maxRetries). Retrying in 30 seconds... Error: $($_.Exception.Message)"
                Start-Sleep -Seconds 30
              } else {
                Write-Warning "Failed to delete resource group after $maxRetries attempts. Error: $($_.Exception.Message)"
              }
            }
          }
        }
        
        # Purge any soft-deleted Key Vaults from this build
        # Vault names use KeyVaultBaseName (e.g., f20585pr5240-ts, f20585pr5240-r4, etc.)
        $vaultPattern = "$keyVaultBaseName*"
        Write-Host "Checking for soft-deleted Key Vaults matching pattern: $vaultPattern"
        $softDeletedVaults = Get-AzKeyVault -InRemovedState -ErrorAction SilentlyContinue | Where-Object {
          $_.VaultName -like $vaultPattern
        }
        
        if ($softDeletedVaults.Count -eq 0) {
          Write-Host "No soft-deleted vaults found to purge"
        } else {
          Write-Host "Found $($softDeletedVaults.Count) soft-deleted vault(s) to purge"
          
          $results = $softDeletedVaults | ForEach-Object -Parallel {
            $vaultName = $_.VaultName
            $vaultLocation = $_.Location
            try {
              Remove-AzKeyVault -VaultName $vaultName -Location $vaultLocation -InRemovedState -Force -ErrorAction Stop
              [PSCustomObject]@{ Vault = $vaultName; Status = "Success" }
            }
            catch {
              [PSCustomObject]@{ Vault = $vaultName; Status = "Failed: $($_.Exception.Message)" }
            }
          } -ThrottleLimit 10
          
          $results | ForEach-Object {
            if ($_.Status -eq "Success") {
              Write-Host "Successfully purged vault: $($_.Vault)"
            } else {
              Write-Warning "Failed to purge vault $($_.Vault). $($_.Status)"
            }
          }
          
          $successCount = ($results | Where-Object { $_.Status -eq "Success" }).Count
          Write-Host "Completed purging: $successCount of $($softDeletedVaults.Count) vaults"
        }
      

- template: ./cleanup-aad.yml

- job: deleteImage
  displayName: 'Delete Image'
  pool:
    name: '$(DefaultLinuxPool)'
    vmImage: '$(LinuxVmImage)'
  steps:
  - task: AzureCLI@2
    displayName: 'Delete Image'
    inputs:
      azureSubscription: $(ConnectedServiceName)
      scriptType: pscore
      scriptLocation: InlineScript
      inlineScript: |
        $repositories = "r4_fhir-server", "r4b_fhir-server", "stu3_fhir-server", "r5_fhir-server"
        foreach ($repositoryName in $repositories) {
          $result = az acr manifest list-metadata --registry $(azureContainerRegistryName) --name $repositoryName --query "[?tags[0]=='$(ImageTag)']" -o tsv
          if ($result -ne $null) {
            Write-Host "Deleting image - $repositoryName $(ImageTag)"
            az acr repository delete --name $(azureContainerRegistryName) --image "${repositoryName}:$(ImageTag)" --yes
          } else {
            Write-Host "Image not found - $repositoryName $(ImageTag)"
          }  
        }