Prefetch organization pending members

Moves the pending member lookup into prefetch, which runs through a
thread pool sized by max_parallelism, instead of calculate, which runs
serially. The result is memoized so the API request count is unchanged.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d95a67cd-ec62-497a-99fc-cf447ee1d49b

Author: john7doe

lib/entitlements/backend/github_org/controller.rb

@@ -140,8 +140,14 @@ def validate_config!(key, data)
           end
         end
 
+        # Pre-fetch the current state of the organization from the API. Both of these are memoized
+        # by the provider, so calling them here means `calculate` reuses the result instead of
+        # making the request itself. Entitlements runs `prefetch` for every group through a thread
+        # pool sized by `max_parallelism`, whereas `calculate` runs serially, so fetching here lets
+        # these requests overlap across organizations.
         def prefetch
           existing_groups
+          provider.pending_members
         end
 
         private

spec/unit/entitlements/backend/github_org/controller_spec.rb

@@ -603,7 +603,7 @@
 
         service = subject.send(:provider).github
         expect(service).to receive(:members_and_roles_from_rest).and_return(answer2)
-        expect(service).to receive(:pending_members).exactly(2).times.and_return(Set.new)
+        expect(service).to receive(:pending_members).exactly(3).times.and_return(Set.new)
 
         expect(logger).to receive(:debug).with("Loading organization members and roles for kittensinc from cache")
         expect(logger).to receive(:debug).with("Currently kittensinc has 1 admin(s) and 2 member(s)")
@@ -845,6 +845,7 @@
 
       github_double = instance_double(Entitlements::Backend::GitHubOrg::Provider)
       allow(subject).to receive(:provider).and_return(github_double)
+      allow(github_double).to receive(:pending_members).and_return(Set.new)
       allow(github_double).to receive(:read).with("cn=member,ou=kittensinc,ou=GitHub,dc=github,dc=com").and_return({})
       allow(github_double).to receive(:read).with("cn=admin,ou=kittensinc,ou=GitHub,dc=github,dc=com").and_return({})
 
@@ -868,6 +869,7 @@
 
       github_double = instance_double(Entitlements::Backend::GitHubOrg::Provider)
       allow(subject).to receive(:provider).and_return(github_double)
+      allow(github_double).to receive(:pending_members).and_return(Set.new)
       dns.each do |dn|
         allow(github_double).to receive(:read).with(dn).and_return({})
       end
@@ -911,6 +913,7 @@
 
       github_double = instance_double(Entitlements::Backend::GitHubOrg::Provider)
       allow(subject).to receive(:provider).and_return(github_double)
+      allow(github_double).to receive(:pending_members).and_return(Set.new)
       allow(github_double).to receive(:read).with(admin_dn).and_return(admin_group)
       allow(github_double).to receive(:read).with(member_dn).and_return(member_group)