plugin.xml <dependency> tag commit attribute doesn't work as documented for branches about cordova-lib HOT 1 OPEN

I was about to open a bug on cordova-fetch with this exact same behaviour but wasn't entirely sure if it should be opened there or here, on cordova-lib. Anyway, I'll just use this issue and expand with my findings on the situation, hopefully it will help understand the real root of the problem.

As reported here, there's a mismatch between the public documentation and the behaviour experienced when installing a cordova plugin that in turn depends on another plugin and specified the commit attribute.

https://github.com/apache/cordova-lib/blob/rel/10.0.0/src/plugman/install.js#L306 : Here the model representing the dependency contains all the correct information as obtained from PluginInfo, namely, URL, ID, git_ref, etc, they are all correctly parsed. Example:

{
    "id": "cordova-plugin-secure-storage",
    "version": "",
    "url": "<https://github.com/OutSystems/cordova-plugin-secure-storage.git>",
    "subdir": "",
    "commit": "2.6.8-OS5",
    "git_ref": "2.6.8-OS5",
    "install_dir": "/Users/calcifer/Development/tmp/test-plugin-dependency/myapp/plugins/cordova-plugin-secure-storage"
}

In fact, this is the value of dep, the input argument for installDependency but internally it does

> target
"https://github.com/OutSystems/cordova-plugin-secure-storage.git"
> dest
"/Users/calcifer/Development/tmp/test-plugin-dependency/myapp"
> opts
{
    "cli_variables": {},
    "save": true,
    "searchpath": [],
    "link": false,
    "pluginInfoProvider": {
        ...
    },
    "usePlatformWww": true,
    "force": false,
    "save_exact": false,
    "production": true,
    "is_top_level": false,
    "graph": {
        ...
    },
    "platformVersion": "9.0.0",
    "subdir": ".",
    "git_ref": "2.6.8-OS5",
    "expected_id": "cordova-plugin-secure-storage",
    "client": "plugman"
}

As we can see, git_ref property is correctly set, however, cordova-fetch does nothing with that information and just ends up calling npm install with the provided URL alone.

This is why I wasn't sure if this is a bug here or on cordova-fetch.

This is replicable on cordova-cli 10.0.0.

from cordova-lib.