runtime-upgrade.yml

---
name: Runtime Upgrade

on:
  pull_request:
    branches: [main, testnet]

permissions: read-all

env:
  RUNNER_VM_NAME: "github-runner-$GITHUB_RUN_ID-attempt-$GITHUB_RUN_ATTEMPT"
  RESOURCE_GROUP: "github-runner-$GITHUB_RUN_ID-attempt-$GITHUB_RUN_ATTEMPT"
  AZ_LOCATION: "westus3"

jobs:
  setup:
    runs-on: ubuntu-22.04
    outputs:
      target_chain: ${{ steps.testnet-env.outputs.target_chain || steps.mainnet-env.outputs.target_chain }}
      boot_node: ${{ steps.testnet-env.outputs.boot_node || steps.mainnet-env.outputs.boot_node }}
      rpc_url: ${{ steps.testnet-env.outputs.rpc_url || steps.mainnet-env.outputs.rpc_url }}
      https_rpc_url: ${{ steps.testnet-env.outputs.https_rpc_url || steps.mainnet-env.outputs.https_rpc_url }}
      release_tag: ${{ steps.testnet-env.outputs.release_tag || steps.mainnet-env.outputs.release_tag }}
      artifact_name: ${{ steps.testnet-env.outputs.artifact_name || steps.mainnet-env.outputs.artifact_name }}
      last_block_hash: ${{ steps.last-block-info.outputs.last_block_hash }}
      last_block_number: ${{ steps.last-block-info.outputs.last_block_number }}

    steps:
      - uses: actions/checkout@v4

      - name: Set-Up
        run: |
          sudo apt-get update
          sudo apt install -y jq

      - name: Testnet ENV
        id: testnet-env
        if: github.base_ref == 'testnet'
        run: |
          # shellcheck disable=SC2129
          echo "target_chain=testnet" >> "$GITHUB_OUTPUT"
          echo "boot_node=/dns4/cc3-test-bootnode.creditcoin.network/tcp/30333/p2p/12D3KooWAxmsWr6iEjFyLqQBzfLvbCRTAhYBeszyr8UWgQx6Zu7K" >> "$GITHUB_OUTPUT"
          echo "rpc_url=wss://rpc.cc3-testnet.creditcoin.network:443/ws" >> "$GITHUB_OUTPUT"
          echo "https_rpc_url=https://rpc.cc3-testnet.creditcoin.network/rpc" >> "$GITHUB_OUTPUT"
          RELEASE_TAG=$(.github/extract-release-tag.sh "testnet")
          echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
          echo "artifact_name=creditcoin-$RELEASE_TAG-$(uname -m)-unknown-linux-gnu.zip" >> "$GITHUB_OUTPUT"

      - name: Mainnet ENV
        id: mainnet-env
        if: github.base_ref == 'main'
        run: |
          # shellcheck disable=SC2129
          echo "target_chain=main" >> "$GITHUB_OUTPUT"
          echo "boot_node=/dns4/TODO-fix-this" >> "$GITHUB_OUTPUT"
          echo "rpc_url=wss://rpc.cc3-mainnet.creditcoin.network:443/ws" >> "$GITHUB_OUTPUT"
          echo "https_rpc_url=https://rpc.cc3-mainnet.creditcoin.network/rpc" >> "$GITHUB_OUTPUT"
          RELEASE_TAG=$(.github/extract-release-tag.sh "mainnet")
          echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
          echo "artifact_name=creditcoin-$RELEASE_TAG-$(uname -m)-unknown-linux-gnu.zip" >> "$GITHUB_OUTPUT"

      - name: Store last block info
        id: last-block-info
        run: |
          # store info about the last finalized block before the fork
          # WARNING: using getBlockHash() instead of getFinalizedHead() b/c PoW doesn't have finalization
          LAST_BLOCK=$(curl --silent -H "Content-Type: application/json" \
               -d '{"id": 1, "jsonrpc": "2.0", "method": "chain_getBlockHash", "params": [] }' \
               ${{ env.HTTPS_RPC_URL }} | jq -r .result)
          echo "$LAST_BLOCK" > last-block.hash
          echo "last_block_hash=$LAST_BLOCK" >> "$GITHUB_OUTPUT"

          while true; do
              curl --silent -H "Content-Type: application/json" \
                   -d "{\"id\": 1, \"jsonrpc\": \"2.0\", \"method\": \"chain_getBlock\", \"params\": [\"$LAST_BLOCK\"] }" \
                   ${{ env.HTTPS_RPC_URL }} | jq -r .result > last-block.json
              LAST_BLOCK_NUMBER=$(jq -r .block.header.number last-block.json)

              if [ "$LAST_BLOCK_NUMBER" != "null" ]; then
                break
              else
                echo "INFO: retry fetching block infor for $LAST_BLOCK"
                sleep 60
              fi
          done
          echo "last_block_number=$LAST_BLOCK_NUMBER" >> "$GITHUB_OUTPUT"
        env:
          HTTPS_RPC_URL: ${{ steps.testnet-env.outputs.https_rpc_url || steps.mainnet-env.outputs.https_rpc_url }}

      - name: Upload last block info
        uses: actions/upload-artifact@v4
        with:
          name: last-block-info
          path: "last-block*"
          if-no-files-found: error

  build-sut:
    runs-on: ubuntu-22.04

    steps:
      - uses: actions/checkout@v4

      - name: Set-Up
        run: |
          sudo apt-get update
          sudo apt install -y curl

      - name: Install protobuf
        uses: arduino/setup-protoc@v3
        with:
          repo-token: ${{ secrets.GITHUB_TOKEN }}

      - name: Configure rustc version
        run: |
          RUSTC_VERSION=$(grep channel rust-toolchain.toml | tail -n1 | tr -d " " | cut -f2 -d'"')
          echo "RUSTC_VERSION=$RUSTC_VERSION" >> "$GITHUB_ENV"

      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ env.RUSTC_VERSION }}
          target: wasm32-unknown-unknown
          profile: minimal
          override: true
      - uses: Swatinem/rust-cache@v2

      - name: Build SUT
        uses: actions-rs/cargo@v1
        with:
          command: build
          args: --release

      - name: Upload creditcoin3-node binary
        uses: actions/upload-artifact@v4
        with:
          name: creditcoin3-node
          path: target/release/creditcoin3-node

      - name: Upload WASM runtime
        uses: actions/upload-artifact@v4
        with:
          name: creditcoin3_runtime.compact.compressed.wasm
          path: target/release/wbuild/creditcoin3-runtime/creditcoin3_runtime.compact.compressed.wasm

  setup-self-hosted:
    needs:
      - setup
      - deploy-github-runner
    runs-on:
      [self-hosted, "${{ needs.deploy-github-runner.outputs.runner_vm_name }}"]

    steps:
      - name: Grant everyone permissions on /mnt
        run: |
          sudo chmod a+rwx /mnt

  fork-creditcoin:
    needs:
      - setup
      - setup-self-hosted
      - live-sync-creditcoin
      - deploy-github-runner
    runs-on:
      [self-hosted, "${{ needs.deploy-github-runner.outputs.runner_vm_name }}"]

    steps:
      - uses: actions/checkout@v4

      - name: Download creditcoin3-node for release ${{ needs.setup.outputs.release_tag }}
        uses: i3h/download-release-asset@v1
        with:
          owner: gluwa
          repo: creditcoin3
          tag: ${{ needs.setup.outputs.release_tag }}
          file: ${{ needs.setup.outputs.artifact_name }}

      - name: Download creditcoin-fork
        uses: i3h/download-release-asset@v1
        with:
          owner: gluwa
          repo: creditcoin-fork
          tag: latest
          file: creditcoin-fork

      - name: Start local creditcoin3-node for ${{ needs.setup.outputs.target_chain }}
        run: |
          # see https://opensource.com/article/18/5/how-find-ip-address-linux
          IP_ADDRESS=$(curl https://ifconfig.me)
          echo "INFO: IP_ADDRESS=$IP_ADDRESS"

          sudo apt-get update
          sudo apt install -y unzip

          unzip creditcoin-*-unknown-linux-gnu.zip
          chmod a+x ./creditcoin3-node

          ./creditcoin3-node --version
          ./creditcoin3-node \
            --name "test-node-$GITHUB_RUN_ID-attempt-$GITHUB_RUN_ATTEMPT" \
            --chain ${{ needs.setup.outputs.target_chain }} \
            --bootnodes "${{ needs.setup.outputs.boot_node }}" \
            --prometheus-external \
            --telemetry-url "wss://telemetry.creditcoin.network/submit/ 0" \
            --base-path /mnt \
            --public-addr "/dns4/$IP_ADDRESS/tcp/50555" \
            --port 50555 >creditcoin3-node-used-for-fork.log 2>&1 &

      - name: Wait for creditcoin3-node to initialize
        run: |
          .github/wait-for-creditcoin.sh

      - name: Create fork
        run: |
          chmod a+x ./creditcoin-fork

          ./creditcoin-fork --bin ./creditcoin3-node --orig ${{ needs.setup.outputs.target_chain }} \
                            --base dev --name Development \
                            -o creditcoin-fork.json --rpc ws://127.0.0.1:9944

      - name: TERM creditcoin3-node
        continue-on-error: true
        run: |
          killall -TERM creditcoin3-node
          sleep 120

      - name: KILL creditcoin3-node
        continue-on-error: true
        run: |
          killall -KILL creditcoin3-node
          sleep 120

      - name: Upload logs
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: fork-creditcoin-logs
          path: "*.log"

      - name: Upload creditcoin-fork.json
        uses: actions/upload-artifact@v4
        with:
          name: creditcoin-fork.json
          path: creditcoin-fork.json

  live-sync-creditcoin:
    needs:
      - setup
      - setup-self-hosted
      - deploy-github-runner
    runs-on:
      [self-hosted, "${{ needs.deploy-github-runner.outputs.runner_vm_name }}"]

    steps:
      - uses: actions/checkout@v4

      - name: Download creditcoin3-node for release ${{ needs.setup.outputs.release_tag }}
        uses: i3h/download-release-asset@v1
        with:
          owner: gluwa
          repo: creditcoin3
          tag: ${{ needs.setup.outputs.release_tag }}
          file: ${{ needs.setup.outputs.artifact_name }}

      - name: Sync with ${{ needs.setup.outputs.target_chain }} past block number ${{ needs.setup.outputs.last_block_number }}
        run: |
          # see https://opensource.com/article/18/5/how-find-ip-address-linux
          IP_ADDRESS=$(curl https://ifconfig.me)
          echo "INFO: IP_ADDRESS=$IP_ADDRESS"

          sudo apt-get update
          sudo apt install -y unzip

          unzip creditcoin-*-unknown-linux-gnu.zip
          chmod a+x ./creditcoin3-node

          ./creditcoin3-node --version
          ./creditcoin3-node \
            --name "test-node-$GITHUB_RUN_ID-attempt-$GITHUB_RUN_ATTEMPT" \
            --chain ${{ needs.setup.outputs.target_chain }} \
            --bootnodes "${{ needs.setup.outputs.boot_node }}" \
            --prometheus-external --pruning archive \
            --telemetry-url "wss://telemetry.creditcoin.network/submit/ 0" \
            --public-addr "/dns4/$IP_ADDRESS/tcp/50555" \
            --base-path /mnt \
            --port 50555 >creditcoin3-node-initial-live-sync.log 2>&1 &

      - name: Wait for creditcoin3-node to sync past block number ${{ needs.setup.outputs.last_block_number }}
        run: |
          .github/wait-for-sync.sh ${{ needs.setup.outputs.last_block_number }}

      - name: TERM creditcoin3-node
        continue-on-error: true
        run: |
          killall -TERM creditcoin3-node
          sleep 120

      - name: KILL creditcoin3-node
        continue-on-error: true
        run: |
          killall -KILL creditcoin3-node
          sleep 120

      - name: Upload logs
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: live-sync-creditcoin-logs
          path: "*.log"

  test-against-fork:
    needs:
      - setup
      - setup-self-hosted
      - build-sut
      - fork-creditcoin
      - deploy-github-runner
    runs-on:
      [self-hosted, "${{ needs.deploy-github-runner.outputs.runner_vm_name }}"]
    steps:
      - uses: actions/checkout@v4

      - name: Download creditcoin3-node from current PR
        uses: actions/download-artifact@v4
        with:
          name: creditcoin3-node
          path: target/release

      - name: Download creditcoin-fork.json
        uses: actions/download-artifact@v4
        with:
          name: creditcoin-fork.json

      - name: Start a local creditcoin3-node from the fork
        run: |
          chmod a+x ./target/release/creditcoin3-node

          ./target/release/creditcoin3-node --version
          ./target/release/creditcoin3-node --chain ./creditcoin-fork.json --validator --alice --pruning archive \
                            --base-path /mnt >creditcoin3-node-with-forked-chain.log 2>&1 &

      - name: Wait for blockchain to start
        run: |
          .github/wait-for-creditcoin.sh

      - name: Install Docker engine
        run: |
          .github/install-docker-engine-from-upstream.sh

      - name: Install JS Dependencies
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - working-directory: cli
        run: |
          npm install -g yarn
          npm install -g node-gyp
          yarn install
          yarn build

      - name: Configure rustc version
        run: |
          RUSTC_VERSION=$(grep channel rust-toolchain.toml | tail -n1 | tr -d " " | cut -f2 -d'"')
          echo "RUSTC_VERSION=$RUSTC_VERSION" >> "$GITHUB_ENV"
          sudo apt install -y gcc

      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ env.RUSTC_VERSION }}
          profile: minimal
          override: true

      - name: Install Subwasm
        uses: actions-rs/cargo@v1
        with:
          command: install
          args: --locked --git https://github.com/chevdor/subwasm --tag v0.17.1

      - name: Download WASM runtime from current PR
        id: download-wasm
        uses: actions/download-artifact@v4
        with:
          name: creditcoin3_runtime.compact.compressed.wasm

      - name: Upgrade WASM
        working-directory: cli
        run: |
          node dist/scripts/runtimeUpgrade.js ws://127.0.0.1:9944  ../creditcoin3_runtime.compact.compressed.wasm //Alice 0

      - name: Execute blockchain integration tests
        working-directory: ./cli
        run: |
          yarn install
          yarn test:blockchain
        env:
          BLOCKCHAIN_TESTS_GLOBAL_SETUP: './runtimeUpgradeTestingAgainstFork.ts'

      - name: Configure testing environment
        id: test-env
        working-directory: ./cli
        run: |
          yarn install
          # NOTE: `creditcoin-fork --base dev` so we have development accounts here
          EVM_PRIVATE_KEY=$(node dist/test/blockchainSetup.js)

          echo "url=http://127.0.0.1:9944" >> "$GITHUB_OUTPUT"
          echo "private_key=$EVM_PRIVATE_KEY" >> "$GITHUB_OUTPUT"

      - name: Execute smart contract test tool
        working-directory: ./testing
        run: |
          ./evm-network-test.sh ${{ steps.test-env.outputs.url }} ${{ steps.test-env.outputs.private_key }}

      - name: Upload logs
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-against-fork-logs
          path: "*.log"

      - name: Kill creditcoin3-node
        run: |
          killall -9 creditcoin3-node

  test-against-disconnected-live-node:
    # execute only against Testnet b/c we don't have sudo key for Mainnet
    # if: github.base_ref == 'testnet'
    # skip upgrades against disconnected live nodes, see
    # https://gluwa.atlassian.net/wiki/spaces/CB/pages/1119912022/Context+decision+for+CSUB-861+runtime+upgrade+testing+against+disconnected+node
    if: false
    needs:
      - build-sut
      - setup
      - setup-self-hosted
      - live-sync-creditcoin
      - deploy-github-runner
    runs-on:
      [self-hosted, "${{ needs.deploy-github-runner.outputs.runner_vm_name }}"]
    steps:
      - uses: actions/checkout@v4

      - name: Download creditcoin3-node from current PR
        uses: actions/download-artifact@v4
        with:
          name: creditcoin3-node
          path: target/release

      - name: Start a disconnected creditcoin3-node
        run: |
          chmod a+x ./target/release/creditcoin3-node
          ./target/release/creditcoin3-node --version

          # WARNING: using different port b/c the network remembers there was a node
          # at this address previously. We don't want to be connected to the chain !!!
          ./target/release/creditcoin3-node \
            --port 44444 \
            --name "test-node-disconnected-$GITHUB_RUN_ID-attempt-$GITHUB_RUN_ATTEMPT" \
            --chain ${{ needs.setup.outputs.target_chain }} \
            --validator --pruning archive \
            --prometheus-external \
            --telemetry-url "wss://telemetry.creditcoin.network/submit/ 0" \
            --base-path /mnt >creditcoin3-node-disconnected-live-node.log 2>&1 &

      - name: Wait for blockchain to start
        run: |
          .github/wait-for-creditcoin.sh

      # check this eventhough it should be true unless live-sync screws up!
      - name: Check if creditcoin3-node is past block number ${{ needs.setup.outputs.last_block_number }}
        run: |
          .github/wait-for-sync.sh ${{ needs.setup.outputs.last_block_number }}

      - name: Install JS Dependencies
        uses: actions/setup-node@v4
        with:
          node-version: 20
      - working-directory: cli
        run: |
          npm install -g yarn
          npm install -g node-gyp
          yarn install
          yarn build

      - name: Configure rustc version
        run: |
          RUSTC_VERSION=$(grep channel rust-toolchain.toml | tail -n1 | tr -d " " | cut -f2 -d'"')
          echo "RUSTC_VERSION=$RUSTC_VERSION" >> "$GITHUB_ENV"
          sudo apt install -y gcc

      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          toolchain: ${{ env.RUSTC_VERSION }}
          profile: minimal
          override: true

      - name: Install Subwasm
        uses: actions-rs/cargo@v1
        with:
          command: install
          args: --locked --git https://github.com/chevdor/subwasm --tag v0.17.1

      - name: Download WASM runtime
        id: download-wasm
        uses: actions/download-artifact@v4
        with:
          name: creditcoin3_runtime.compact.compressed.wasm

      - name: Upgrade WASM
        working-directory: cli
        env:
          # WARNING: the node is still running locally
          TARGET_URL: ws://127.0.0.1:9944
          SUDO_SEED: ${{ secrets.TESTNET_SUDO_SEED }}
        run: |
          node dist/scripts/runtimeUpgrade.js "$TARGET_URL" ../creditcoin3_runtime.compact.compressed.wasm "$SUDO_SEED" 0
          sleep 10

      - name: Execute blockchain tests
        working-directory: ./cli
        run: |
          yarn install
          yarn test:blockchain
        env:
          # Note that this is executed only against Testnet/testnet branch
          CREDITCOIN_API_URL: ws://127.0.0.1:9944
          # WARNING: EVM Alice != Substrate Alice
          # WARNING: EVM Alice != Substrate Alice's Associated EVM address
          ALICE_SEED: "${{ secrets.TESTNET_ALICE_SEED }}"
          ALICE_EVM_PK: "${{ secrets.TESTNET_ALICE_EVM_PK }}"
          BOB_SEED: "${{ secrets.TESTNET_BOB_SEED }}"
          BOB_EVM_PK: "${{ secrets.TESTNET_BOB_EVM_PK }}"
          SUDO_SEED: "${{ secrets.TESTNET_SUDO_SEED }}"
          BLOCKCHAIN_TESTS_GLOBAL_SETUP: './${{ needs.setup.outputs.target_chain }}IntegrationTesting.ts'

      - name: Configure testing environment
        id: test-env
        working-directory: ./cli
        run: |
          yarn install
          EVM_PRIVATE_KEY=$(node dist/test/${{ needs.setup.outputs.target_chain }}IntegrationTesting.js)
          echo "url=http://127.0.0.1:9944" >> "$GITHUB_OUTPUT"
          echo "private_key=$EVM_PRIVATE_KEY" >> "$GITHUB_OUTPUT"

      - name: Execute smart contract test tool
        working-directory: ./testing
        run: |
          ./evm-network-test.sh ${{ steps.test-env.outputs.url }} ${{ steps.test-env.outputs.private_key }}

      - name: Upload logs
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: test-against-disconnected-live-node-logs
          path: "*.log"

      - name: Kill creditcoin3-node
        run: |
          # if all went well kill the node. Otherwise GitHub Actions would exit on the
          # previous step killing everything and we don't have to worry about
          # dangling processes
          killall -9 creditcoin3-node

  deploy-github-runner:
    runs-on: ubuntu-22.04
    outputs:
      runner_vm_name: ${{ steps.get-env.outputs.runner_vm_name }}
      resource_group: ${{ steps.get-env.outputs.resource_group }}

    steps:
      - uses: actions/checkout@v4

      - name: Install azure-cli
        run: |
          sudo apt remove azure-cli -y && sudo apt autoremove -y
          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
          sudo apt install -y jq
          az version

      - name: Authorize hosted-runner
        run: |
          mkdir -p ~/.ssh/
          ssh-keygen -q -t rsa -N '' -f ~/.ssh/id_rsa
          cat ~/.ssh/id_rsa.pub >> .github/authorized_keys

      - name: Evaluate env vars
        id: get-env
        run: |
          # WARNING: using env.RUNNER_VM_NAME directly in job outputs above
          # doesn't evaluate the $GITHUB_RUN_ID reference
          echo "runner_vm_name=${{ env.RUNNER_VM_NAME }}" >> "$GITHUB_OUTPUT"
          echo "resource_group=${{ env.RESOURCE_GROUP }}" >> "$GITHUB_OUTPUT"

      - name: Provision VM
        if: env.LC_GITHUB_REPO_ADMIN_TOKEN
        run: |
          echo "INFO: From ENVs: RUNNER_VM_NAME=${{ env.RUNNER_VM_NAME }}"
          echo "INFO: From Step: RUNNER_VM_NAME=${{ steps.get-env.outputs.runner_vm_name }}"

          az login --service-principal --username "${{ secrets.AZURE_APP_ID }}" --password "${{ secrets.AZURE_APP_PASSWORD }}" --tenant "${{ secrets.AZURE_TENANT_ID }}"
          az account set --subscription "Playground Subscription"
          ## az account set -s "${{ secrets.AZURE_SUBSCRIPTION_ID }}"


          # create resource group
          echo "INFO: ${{ steps.get-env.outputs.resource_group }}"
          az group create -n "${{ steps.get-env.outputs.resource_group }}" --location "${{ env.AZ_LOCATION }}"

          # RG Creditcoin-Test is in WestUS and the CPU quota is already full
          # that's why specify a different region here
          az deployment group create -g "${{ steps.get-env.outputs.resource_group }}" -f .github/runner.bicep \
              --parameters location="${{ env.AZ_LOCATION }}" \
              --parameters vmName="${{ steps.get-env.outputs.runner_vm_name }}" \
              --parameters adminPasswordOrKey="$(cat .github/authorized_keys)" > output.json

          # provision the GitHub Runner binary on the VM
          # passing additional ENV values
          SSH_USER_AT_HOSTNAME=$(jq -r '.properties.outputs.sshUserAtHostname.value' < output.json)
          echo "INFO: $SSH_USER_AT_HOSTNAME"

          export LC_RUNNER_VM_NAME="${{ env.RUNNER_VM_NAME }}"
          until ssh -i ~/.ssh/id_rsa \
              -o SendEnv=LC_GITHUB_REPO_ADMIN_TOKEN,LC_RUNNER_VM_NAME \
              -o StrictHostKeyChecking=no "$SSH_USER_AT_HOSTNAME" < .github/provision-github-runner.sh; do
            echo "DEBUG: retrying ssh connection ..."
            sleep 30
          done
        env:
          LC_GITHUB_REPO_ADMIN_TOKEN: ${{ secrets.GH_REPO_ADMIN_TOKEN }}
          LC_RUNNER_EPHEMERAL: false

  remove-github-runner:
    runs-on: ubuntu-22.04
    needs:
      - deploy-github-runner
      - test-against-fork
      - test-against-disconnected-live-node
    if: ${{ always() && needs.deploy-github-runner.result != 'skipped' }}

    steps:
      - uses: actions/checkout@v4

      - name: Evaluate env vars
        id: get-env
        run: |
          # WARNING: using env.RUNNER_VM_NAME directly in job outputs above
          # doesn't evaluate the $GITHUB_RUN_ID reference
          echo "resource_group=${{ env.RESOURCE_GROUP }}" >> "$GITHUB_OUTPUT"

      - name: Install azure-cli
        run: |
          sudo apt remove azure-cli -y && sudo apt autoremove -y
          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
          az version

      - name: Remove VM
        run: |
          echo "INFO: RUNNER_VM_NAME=${{ env.RUNNER_VM_NAME }}"

          az login --service-principal --username "${{ secrets.AZURE_APP_ID }}" --password "${{ secrets.AZURE_APP_PASSWORD }}" --tenant "${{ secrets.AZURE_TENANT_ID }}"
          az account set --subscription "Playground Subscription"
          az group delete --yes -n "${{ steps.get-env.outputs.resource_group }}"

      - name: Upload logs
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: "Azure resources"
          path: azure_resource_list.json