Isolate live-test resource group per run; scope concurrency to the branch

The live-tests workflow used a fixed resource group name
(GitHubAction_CI_Group) plus a repo-wide concurrency group. Because the
test jobs run behind the Automation test approval gate, an unapproved run
sits in the 'waiting' state holding the shared concurrency lock, which
blocked live-tests on every other PR indefinitely.

Give each run its own resource group by suffixing the name with
github.run_id, and reference it via the RG_POSITIVE env var everywhere
(previously nine jobs used the literal name). With per-run isolation the
repo-wide lock is no longer needed to prevent collisions, so the
concurrency group is now scoped to the branch (github.ref) and only
prevents pile-ups on rapid pushes to the same ref - never across PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: MaddyMicrosoft

.github/workflows/azure-login-live-tests.yml

@@ -9,16 +9,19 @@ permissions:
   id-token: write
   contents: read
 
-# One resource group is shared by every job in this run, so serialize runs to
-# avoid one run tearing down another's group.
+# Each run provisions its own uniquely-named resource group (suffixed with the
+# run id), so concurrent runs on different branches/PRs never collide or tear
+# down each other's group. The concurrency group is branch-scoped only to avoid
+# piling up runs on rapid pushes to the same ref - it does NOT serialize across
+# the whole repo, so an unapproved run on one PR can never block another.
 concurrency:
-  group: azure-login-live-tests
+  group: azure-login-live-tests-${{ github.ref }}
   cancel-in-progress: false
 
 env:
   # Created once in setup; the positive and embedded "can access" assertions
-  # target this group.
-  RG_POSITIVE: GitHubAction_CI_Group
+  # target this group. Suffixed with the run id so every run is isolated.
+  RG_POSITIVE: GitHubAction_CI_Group_${{ github.run_id }}
   LOCATION: eastus
   # Intentionally NEVER created: the negative permission/not-found assertions
   # target this name so they fail as expected.
@@ -77,7 +80,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -121,7 +124,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -165,7 +168,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Login with creds, wrong boolean value
       uses: ./
@@ -176,7 +179,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Login with creds, allow no subscription
       uses: ./
@@ -188,7 +191,7 @@ jobs:
     - name: Run Azure Cli
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
  
     - name: Run Azure PowerShell
       uses: azure/powershell@v3
@@ -521,7 +524,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Run Azure PowerShell
       id: ps_8
@@ -531,7 +534,7 @@ jobs:
         azPSVersion: "latest"
         inlineScript: |
           (Get-AzContext).Environment.Name -eq 'AzureCloud'
-          (Get-AzResourceGroup -Name GitHubAction_CI_Group).ResourceGroupName -eq 'GitHubAction_CI_Group'
+          (Get-AzResourceGroup -Name $env:RG_POSITIVE).ResourceGroupName -eq $env:RG_POSITIVE
 
     - name: Check Last step failed
       if: steps.ps_8.outcome == 'success'
@@ -549,7 +552,7 @@ jobs:
     - name: Run Azure Cli 
       run: |
         az account show --output none
-        az group show --name GitHubAction_CI_Group --output none
+        az group show --name "$RG_POSITIVE" --output none
 
     - name: Run Azure PowerShell
       id: ps_9
@@ -559,7 +562,7 @@ jobs:
         azPSVersion: "latest"
         inlineScript: |
           (Get-AzContext).Environment.Name -eq 'AzureCloud'
-          (Get-AzResourceGroup -Name GitHubAction_CI_Group).ResourceGroupName -eq 'GitHubAction_CI_Group'
+          (Get-AzResourceGroup -Name $env:RG_POSITIVE).ResourceGroupName -eq $env:RG_POSITIVE
 
     - name: Check Last step failed
       if: steps.ps_9.outcome == 'success'