ci: add Azure workflow scoping OIDC tests via azureoidc build tag

Addresses review feedback on PR #1794:
#1794 (comment)

Replaces the brittle enumerated `-run '^(TestA|TestB)$'` regex with a
new `azureoidc` build tag. Tests opt in by adding the tag, so adding
or removing OIDC-compatible tests no longer requires editing the
workflow.

- TerraformAzureContainerAppExample and TerraformAzureKeyVaultExample
  carry `azure || azureoidc`, so they remain part of the default
  `azure` build while also being selectable via the narrower OIDC tag.
- Workflow runs `go test -tags azureoidc ./test/azure/...`.

Author: james00012

.github/workflows/azure-integration-tests.yml

@@ -0,0 +1,94 @@
+name: Azure Integration Tests
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'modules/azure/**'
+      - 'test/azure/**'
+      - 'examples/azure/**'
+      - 'go.mod'
+      - 'go.sum'
+      - 'mise.toml'
+      - '.github/workflows/azure-integration-tests.yml'
+  pull_request:
+    paths:
+      - 'modules/azure/**'
+      - 'test/azure/**'
+      - 'examples/azure/**'
+      - 'go.mod'
+      - 'go.sum'
+      - 'mise.toml'
+      - '.github/workflows/azure-integration-tests.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: azure-integration-tests-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  azure-integration-tests:
+    name: Azure Integration Tests
+    if: >-
+      github.event_name != 'pull_request' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install mise
+        uses: jdx/mise-action@v3
+        with:
+          version: 2025.12.10
+          experimental: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Go module cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Download Go modules
+        run: go mod download
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v2
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Run Azure integration tests
+        env:
+          ARM_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+          ARM_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+          ARM_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          ARM_USE_OIDC: "true"
+        run: |
+          set -o pipefail
+          mkdir -p /tmp/logs
+          # Scope: tests that opt into OIDC via the `azureoidc` build tag.
+          # AzureRM 2.x examples cannot authenticate via OIDC and are gated
+          # behind a follow-up provider-upgrade effort; they remain on the
+          # default `azure` tag.
+          go test -v -p 1 -tags azureoidc -count=1 -timeout 45m \
+            ./test/azure/... 2>&1 | tee /tmp/logs/azure-integration-tests.log
+
+      - name: Upload test logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: azure-integration-test-logs
+          path: /tmp/logs/
+          retention-days: 14

test/azure/terraform_azure_container_apps_example_test.go

@@ -1,5 +1,5 @@
-//go:build azure
-// +build azure
+//go:build azure || azureoidc
+// +build azure azureoidc
 
 package test_test
 

test/azure/terraform_azure_keyvault_example_test.go

@@ -1,5 +1,5 @@
-//go:build azure
-// +build azure
+//go:build azure || azureoidc
+// +build azure azureoidc
 
 package test_test