Don't search secondary repositories if not required

docs/repositories.md

@@ -168,12 +168,10 @@ There can be more than one secondary package source.
 
 {{% note %}}
 
-All package sources (including secondary sources) will be searched during the package lookup
-process. These network requests will occur for all sources, regardless of if the package is
-found at one or more sources.
+Secondary sources are searched only for packages that are not found in primary
+sources.
 
-If you wish to avoid this, you may explicitly specify which source to search in for a particular
-package.
+You may explicitly specify which source to search in for a particular package.
 
 ```bash
 poetry add --source pypi httpx

src/poetry/repositories/pool.py

@@ -164,8 +164,17 @@ def find_packages(self, dependency: Dependency) -> list[Package]:
         if repository is not None and not self._ignore_repository_names:
             return self.repository(repository).find_packages(dependency)
 
-        packages = []
-        for repo in self._repositories:
+        packages: list[Package] = []
+        for index, repo in enumerate(self._repositories):
+            if (
+                self._secondary_start_idx is not None
+                and index >= self._secondary_start_idx
+                and packages
+            ):
+                # We've found packages in the primary repositories, don't search
+                # secondary repositories.
+                break
+
             packages += repo.find_packages(dependency)
 
         return packages

tests/repositories/test_pool.py

@@ -2,6 +2,9 @@
 
 import pytest
 
+from poetry.core.packages.package import Package
+
+from poetry.factory import Factory
 from poetry.repositories import Pool
 from poetry.repositories import Repository
 from poetry.repositories.exceptions import PackageNotFound
@@ -71,3 +74,22 @@ def test_repository_with_normal_default_and_secondary_repositories():
     assert pool.repository("foo") is repo1
     assert pool.repository("bar") is repo2
     assert pool.has_default()
+
+
+def test_secondary_repository_is_not_always_searched() -> None:
+    package1 = Package("foo", "1.0.0")
+    primary = Repository("primary", [package1])
+
+    package2 = Package("foo", "2.0.0")
+    secondary = Repository("secondary", [package2])
+
+    pool = Pool()
+    pool.add_repository(primary)
+    pool.add_repository(secondary, secondary=True)
+
+    # Only the package in the primary repository is found, even though there's a newer
+    # version in a secondary repository.
+    dependency = Factory.create_dependency("foo", "*")
+    packages = pool.find_packages(dependency)
+    assert len(packages) == 1
+    assert packages[0].pretty_version == "1.0.0"