Add concurrency: group to repo-based deploy/delete workflows to serialize shared state-archive access

[sk593]

Background

Follow-up from PR #12840 (review by @kachawla).

The four repo-based deploy/delete workflows (run-rad-commands-aws.yml, run-rad-commands-azure.yml, delete-aws.yml, delete-azure.yml) share a single durable state archive (the OCI package selected by RADIUS_STATE_*, or the radius-state git orphan branch). Each run does rad startup (restore) → commands → rad shutdown (persist).

Gap

None of the workflows declares a concurrency: group. If two runs against the same repo/environment overlap, they race on the shared archive: one run's rad shutdown can overwrite state the other run restored, or two runs can push conflicting snapshots, corrupting the archive.

Proposed fix

Add a concurrency: group (keyed by workflow + environment/ref, with an appropriate cancel-in-progress policy) to serialize runs that share a state archive.

Scope

Not required to fix #12838 — that failure is deterministic within a single run. This is an unrelated robustness improvement and is intentionally out of scope for #12840.

[radius-triage]

👋 @sk593 Thanks for filing this bug report.

A project maintainer will review this report and get back to you soon. If you'd like immediate help troubleshooting, please visit our Discord server.

For more information on our triage process please visit our triage overview

[nicolejms]

Closing following an issue audit against Radius main at ec97901 and the current referenced implementations.

The complete four-workflow concurrency gap is fixed in their canonical home. All AWS/Azure deploy and delete templates now declare the identical repository-wide group radius-routes-gateway-${{ github.repository }} with cancel-in-progress:false. This serializes running deploy/delete operations across workflows and environments in the same repository, covering the reported shared archive race more broadly than a workflow-specific key. gh verifies ai-extensions#672 merged and introduced these blocks. Radius #12850 was closed without merging after relocation, so it is not the fix. Recommendation concerns current canonical templates; previously copied consumer workflows do not update retroactively.

Evidence:

• Manage routes Gateway lifecycle in extension workflows ai-extensions#672 — gh verified MERGED on 2026-09-01; merge commit 14951127ae5f7a0bcdb5e2689b18a9ec7d8e8d4d; PR explicitly describes the shared non-cancelling group.
• https://github.com/radius-project/ai-extensions/blob/2c789d2e2a309d94e4164a1719c64dda580be36c/.github/extension/run-rad-commands-aws.yml#L37-L39 — canonical AWS deploy concurrency.
• https://github.com/radius-project/ai-extensions/blob/2c789d2e2a309d94e4164a1719c64dda580be36c/.github/extension/run-rad-commands-azure.yml#L37-L39 — same group for Azure deploy.
• https://github.com/radius-project/ai-extensions/blob/2c789d2e2a309d94e4164a1719c64dda580be36c/.github/extension/delete-aws.yml#L44-L46 — same group for AWS delete.
• https://github.com/radius-project/ai-extensions/blob/2c789d2e2a309d94e4164a1719c64dda580be36c/.github/extension/delete-azure.yml#L44-L46 — same group for Azure delete.
• Remove duplicated Repo Radius extension workflows #12719 — gh verified MERGED on 2026-08-31; removes the duplicate Radius workflow tree.
• Add concurrency groups to repo-based deploy/delete workflows #12850 (comment) — closed for relocation, not merged; independent canonical fix verified above.