Prove the plugin source test by the side effect it prevents

The fixture left the plugin index without load paths, so removing the
guard failed on a missing path rather than on the plugin running. Give
the plugin something to load and assert it never wrote its marker.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hsbt

lib/rubygems/request_set.rb

@@ -406,10 +406,10 @@ def load_lockfile(lock_file) # :nodoc:
     parser.dependencies.each_value do |dep|
       requirements = dep.requirement.as_list
 
-      # A dependency marked `!` in the DEPENDENCIES section carries no version
-      # requirement, so pin it to the version its own section resolved. For a
-      # PATH section that is the version of the gemspec on disk, not the one
-      # the lockfile records.
+      # A dependency the lockfile ties to a source replaces whatever it asks
+      # for with the version that source resolved, the way the parser this
+      # replaced did. For a PATH section that is the version of the gemspec on
+      # disk, not the one the lockfile records.
       if dep.source && (version = locked_versions[dep.name])
         requirements = [version]
       end

test/rubygems/test_gem_request_set.rb

@@ -553,31 +553,43 @@ def test_load_lockfile_does_not_load_plugins_for_a_plugin_source_section
     require "bundler"
     require "bundler/plugin"
 
-    FileUtils.mkdir_p File.join(@tempdir, ".bundle", "plugin", "plugins", "evil")
+    plugin = File.join @tempdir, ".bundle", "plugin", "plugins", "example"
+    loaded = File.join @tempdir, "plugin-was-loaded"
+
+    FileUtils.mkdir_p File.join(plugin, "lib")
+
     File.open File.join(@tempdir, "Gemfile"), "w" do |io|
       io.puts 'source "https://rubygems.org"'
     end
-    File.open File.join(@tempdir, ".bundle", "plugin", "plugins", "evil", "plugins.rb"), "w" do |io|
-      io.puts "raise 'plugin code must not run while parsing a lockfile'"
+
+    File.open File.join(plugin, "plugins.rb"), "w" do |io|
+      io.puts "File.write #{loaded.dump}, \"loaded\""
+      io.puts "class ExampleSource"
+      io.puts "  include Bundler::Plugin::API::Source"
+      io.puts "end"
+      io.puts 'Bundler::Plugin::API.source("example_type", ExampleSource)'
     end
+
     File.open File.join(@tempdir, ".bundle", "plugin", "index"), "w" do |io|
       io.puts <<~INDEX
         ---
         commands:
         hooks:
         load_paths:
+          example:
+          - plugins/example/lib
         plugin_paths:
-          evil: plugins/evil
+          example: plugins/example
         sources:
-          evil_type: evil
+          example_type: example
       INDEX
     end
 
     File.open "gem.deps.rb.lock", "w" do |io|
       io.puts <<~LOCKFILE
         PLUGIN SOURCE
           remote: https://gems.example/
-          type: evil_type
+          type: example_type
           specs:
             a (1)
 
@@ -589,10 +601,15 @@ def test_load_lockfile_does_not_load_plugins_for_a_plugin_source_section
       LOCKFILE
     end
 
+    Bundler::Plugin.reset!
+
     rs = Gem::RequestSet.new
     rs.load_lockfile "gem.deps.rb.lock"
 
+    assert_path_not_exist loaded
     assert_equal [dep("a")], rs.dependencies
+  ensure
+    Bundler::Plugin.reset!
   end
 
   def test_load_lockfile_keeps_bundler_root_when_it_cannot_be_swapped