Context

• fix not follow poetry's package source constraint #8414

Package source constraints are strongly suggested for all packages that are expected to be provided only by one specific source to avoid dependency confusion attacks.

https://python-poetry.org/docs/repositories/#package-source-constraint

Summary

• Update the index_finder.rb script to ensure that if a dependency has a package source configuration in pyproject.toml, it won't utilize any other sources as its :main source.
• Please note that the behavior may not completely align with Poetry's behavior.
  • For example, if a package points to a source that is not defined in pyproject.toml, Poetry will raise an exception, but Dependabot will continue to check the default source.
  • Should we consider aligning dependabot behavior with Poetry's in this regard?

User-facing changes

• dependabot bot won't check default source if a package defined its source correctly.

Testing Instructions

[dependabot-core-dev] ~ $ ./bin/dry-run.rb pip lucemia/dependabot-source-constraint --cache=files

Before modification

• dependabot will check https://pypi.org/simple/requests/

=> reading cloned repo from /home/dependabot/tmp/lucemia/dependabot-source-constraint
=> parsing dependency files
=> updating 1 dependencies: requests

=== requests ()
 => checking for updates 1/1
🌍 --> GET https://pypi.org/simple/requests/
🌍 <-- 200 https://pypi.org/simple/requests/
🌍 --> GET https://some.internal.registry.com/pypi/requests/
 => handled error whilst updating requests: private_source_timed_out {:source=>"https://some.internal.registry.com/pypi/"}
🌍 Total requests made: '2'
🎈 Ecosystem Versions log: {:languages=>{:python=>{"raw"=>"^3.7", "max"=>"3.11"}}}

After modification

• dependabot won't check https://pypi.org/simple/requests/

=> reading cloned repo from /home/dependabot/tmp/lucemia/dependabot-source-constraint
=> parsing dependency files
=> updating 1 dependencies: requests

=== requests ()
 => checking for updates 1/1
🌍 --> GET https://some.internal.registry.com/pypi/requests/
 => handled error whilst updating requests: private_source_timed_out {:source=>"https://some.internal.registry.com/pypi/"}
🌍 Total requests made: '1'
🎈 Ecosystem Versions log: {:languages=>{:python=>{"raw"=>"^3.7", "max"=>"3.11"}}}