From 46cecf85ee2c9eac089eb90b7039dc495bf8ebd2 Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Sat, 28 Mar 2026 17:18:55 -0400
Subject: [PATCH] Use static RSA key fixture to fix fabro-github test timeouts

Tests were spawning `openssl genpkey` per test, causing timeouts under
nextest's per-process parallelism with the 4s hard-kill limit. Replace
with a pre-generated key loaded via include_str!.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 lib/crates/fabro-github/src/lib.rs            | 36 +++++++------------
 .../fabro-github/src/testdata/rsa_private.pem | 28 +++++++++++++++
 2 files changed, 40 insertions(+), 24 deletions(-)
 create mode 100644 lib/crates/fabro-github/src/testdata/rsa_private.pem

diff --git a/lib/crates/fabro-github/src/lib.rs b/lib/crates/fabro-github/src/lib.rs
index e6cf18ad3..05db3f592 100644
--- a/lib/crates/fabro-github/src/lib.rs
+++ b/lib/crates/fabro-github/src/lib.rs
@@ -913,20 +913,8 @@ mod tests {
     // sign_app_jwt
     // -----------------------------------------------------------------------
 
-    fn test_rsa_key() -> String {
-        use std::process::Command;
-        let output = Command::new("openssl")
-            .args([
-                "genpkey",
-                "-algorithm",
-                "RSA",
-                "-pkeyopt",
-                "rsa_keygen_bits:2048",
-            ])
-            .output()
-            .expect("openssl should be available");
-        assert!(output.status.success(), "openssl keygen failed");
-        String::from_utf8(output.stdout).unwrap()
+    fn test_rsa_key() -> &'static str {
+        include_str!("testdata/rsa_private.pem")
     }
 
     #[test]
@@ -1165,7 +1153,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         let result = branch_exists(&creds, "owner", "repo", "my-branch", &server.url()).await;
         assert_eq!(result.unwrap(), true);
@@ -1196,7 +1184,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         let result = branch_exists(&creds, "owner", "repo", "no-such-branch", &server.url()).await;
         assert_eq!(result.unwrap(), false);
@@ -1227,7 +1215,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         let result = branch_exists(&creds, "owner", "repo", "broken", &server.url()).await;
         assert!(result.is_err());
@@ -1437,7 +1425,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         let detail = get_pull_request(&creds, "owner", "repo", 42, &server.url())
             .await
@@ -1479,7 +1467,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         let err = get_pull_request(&creds, "owner", "repo", 999, &server.url())
             .await
@@ -1518,7 +1506,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         merge_pull_request(&creds, "owner", "repo", 42, "squash", &server.url())
             .await
@@ -1550,7 +1538,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         let err = merge_pull_request(&creds, "owner", "repo", 42, "squash", &server.url())
             .await
@@ -1583,7 +1571,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         let err = merge_pull_request(&creds, "owner", "repo", 42, "squash", &server.url())
             .await
@@ -1621,7 +1609,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         close_pull_request(&creds, "owner", "repo", 42, &server.url())
             .await
@@ -1653,7 +1641,7 @@ mod tests {
         let pem = test_rsa_key();
         let creds = GitHubAppCredentials {
             app_id: "test".to_string(),
-            private_key_pem: pem,
+            private_key_pem: pem.to_string(),
         };
         let err = close_pull_request(&creds, "owner", "repo", 999, &server.url())
             .await
diff --git a/lib/crates/fabro-github/src/testdata/rsa_private.pem b/lib/crates/fabro-github/src/testdata/rsa_private.pem
new file mode 100644
index 000000000..40605988e
--- /dev/null
+++ b/lib/crates/fabro-github/src/testdata/rsa_private.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDS/REfv+cPQntO
+fOZiSXxXRdREXUvcyTRmCADWAeRka2NT6nXMgcnG0wxhziRb2fbeJi/NkadJde8l
+9+VxbLfulGYBRFVIFKWFnzYn95IOoRHcuGL8OkGD65YmGLJ6I98dBDkIXRT+Xu16
+eEK4OZ2Kgw64rtRZMlvcepiDHKBsfwWbAC1jLJ6U2lmKnq1Gde2W40M67GzKvZhs
+T1u4HzrPYDzNyB0LRP7hzctnGk8GNCadnjmgdj+tmj0DplF9lZffU4SjL8NfND57
+E80ChgCpk1acFL+6TGwgxBuRQZ1iDo4dUvUQGBZz7uAqMSmvux/v4wSOMl/DDbPE
+y8jG5EaDAgMBAAECggEAKrlyOUKr8Gwe+hLSuD53Plj2le1qikf4I10lhjCV5jvU
+vk5xEjuJ94gPLtMGi88EbZHABlmjTX3jMoYTYTeJu3czfLgwqMr9haRq3AcG/Y1i
+R5bS/I5za9pN6mL/6TnQWVjcj7QBp0zju/QUVqfcHgtR9NX6TCGldm0g6xPl7HIi
+ORFEtiKTWR15ucOdJ0DB0RIHwv9jIzaqb+T+MhDwd15HrEZl0wuRGAhVeHqE2Ynl
+nLfFeB2TD53yhzmi6k26TZpKbG7qQag9egveDoAfafe7YRMo9E7KIbkUDNEgokik
+JvJzRvMueWsd2djRTasiO69tj0mNPFEZ221t+0lfoQKBgQDp5FLNmdO24vvlDNYd
+GMgZHNTSW8HcfgS3WFXg7f+qZOZEYXyZeVmByX1s35D0Ujp8igkXy16mtpOmh70v
+t2GaEgXNzNhcTxPnAKSrjSjKBtNV1SWY0DiiGk2DHfQEn26rwK1i6bM27fJWlCww
+/fAaxOFPbUrV/fvdbYqrixQ+8wKBgQDm7og5vQ3Mjzop5D8QeuFLezKOLEkY8JOn
+6RCbWaiwEK9/9uTA07r9jlehx1RRu2M3oqGSGnpl/yCgdCcgu9T0zm4j95dWE5u4
+GOV0Zi3lcQ5BsTjqxyDg844Jlt7rlZiQmUiRkETcz6nfsrXXGdX6mbg1DBaTqw9d
+YZaeoz1eMQKBgA5LErhXzzVc97HOsAMFMa0/Ms5MJzO3S8h8kHr3cGlUUzIYlwm1
+/b9NtemCXBRiNgrIULfwiK89dxZ1Mx2IYmGM+mfSPeKePoQeaPHG5Zg7BI05Qlvt
+VZiqbNQ3b2Mc7yF12+Kwj3Aq6GVcFrtDuXmZUH+PGUSsicjFWfUTwb/7AoGBALPG
+YABq37Iukf4ItNuUfY0wVDP/38vthVVDB+2YR80AwE8jGgPPEJPRWwETVt3lviCS
+l6tQt5Ztna2rnsZJ00fc6DtRxNt6mlAf+Yi6/uHOOGYFnCSRblQQ5rMqY1IM/F8d
+JTREloc7lqgRzKOudjkHsDKDvZOpqGVu0j2fIOgRAoGAYTXTF8jB3qsh5cZBhE38
+5W1edlsqkGfShaCBzyobjvLsbnOMF5jyk/o68BfRpTzzQ2m0SfzRKHpyF4yz1UWH
+SYU0y+9jKyQ1dmYc+D7Y0Y1WHfrSXyp+Ef0k5mGA6ludgg/8/7WvvwjzqphYmmeD
+cFRd9yhNkVVmuGeSkGej8A0=
+-----END PRIVATE KEY-----