Fix panic in PimRoleEligibilitySchedule with NoExpiration type

[EronWright]

Summary

Fixes #4351 - a panic that occurred when creating a PimRoleEligibilitySchedule resource with NoExpiration type without providing a duration field.

Root Cause

The bug was in the inputsToSdk function at custom_pim_eligibility.go:460, where the code unconditionally accessed exp["duration"].StringValue() even when the duration field was nil/not provided.

According to Azure's PIM API schema, the expiration object supports three types:

• AfterDuration: requires duration field (ISO 8601 duration like "P365D")
• AfterDateTime: requires endDateTime field
• NoExpiration: should NOT have either field

Changes

1. Fixed the bug in custom_pim_eligibility.go:

   • Added proper checks for optional duration and endDateTime fields before accessing them
   • Follows the same pattern used elsewhere in the codebase for optional nested fields (see ticketInfo handling)

2. Added comprehensive test coverage in custom_pim_eligibility_test.go:

   • Test for NoExpiration type (previously missing)
   • Test for AfterDateTime type (previously missing)
   • Existing test for AfterDuration type continues to pass

Testing

• ✅ All unit tests pass (make test_provider PROVIDER_TEST_TAGS=unit)
• ✅ Reproduced the panic before the fix
• ✅ Verified the fix resolves the panic
• ✅ Added regression tests for all three expiration types

Notes

This is a P1 panic bug that affects users trying to create permanent PIM role eligibility assignments (which use NoExpiration type).

🤖 Generated with Claude Code

[EronWright]

An extra fix riding in this PR, this fix was applied directly to the v3.10.1 branch, will be needed going forward.

[github-actions]

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

[Copilot]

Pull Request Overview

This PR fixes a bug in PIM eligibility schedule expiration handling and adds necessary OIDC permissions to the release workflow.

• Fixed optional field handling for duration and endDateTime in schedule expiration configuration
• Added test coverage for NoExpiration and AfterDateTime expiration types
• Added OIDC permissions to the docs build dispatch job

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
provider/pkg/resources/customresources/custom_pim_eligibility.go	Fixed bug where duration field was accessed unconditionally; now properly handles optional duration and endDateTime fields based on expiration type
provider/pkg/resources/customresources/custom_pim_eligibility_test.go	Added comprehensive test coverage for NoExpiration and AfterDateTime expiration types
.github/workflows/release.yml	Added required id-token: write and contents: read permissions for OIDC authentication in the docs build job

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 71.42857% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.37%. Comparing base (349017b) to head (d087bfd).
⚠️ Report is 2 commits behind head on master.

Files with missing lines	Patch %	Lines
...esources/customresources/custom_pim_eligibility.go	71.42%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4402   +/-   ##
=======================================
  Coverage   59.37%   59.37%           
=======================================
  Files          91       91           
  Lines       11444    11450    +6     
=======================================
+ Hits         6795     6799    +4     
- Misses       4014     4015    +1     
- Partials      635      636    +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pulumi-bot]

This PR has been shipped in release v3.11.0.