plugin.xml <dependency> tag commit attribute doesn't work as documented for branches

[Lindsay-Needs-Sleep]

Bug Report

Problem

The documentation on how to use plugin.xml dependency tag does not match usage.
Either there is a bug in cordova-lib or the documentation is incorrect.

Here is the documentation:

What is expected to happen?

When installing a plugin that has this dependency tag in plugin.xml:

<dependency id="cordova-plugin-ionic-webview" url="https://github.com/miloproductionsinc/cordova-plugin-ionic-webview.git" commit="2.x-custom" />

I expect that most recent version on branch 2.x-custom should be retrieved.

What does actually happen?

Instead it seems to ignore the commit attribute and fetches the master branch. Here is the log:

Plugin dependency "cordova-plugin-ionic-webview" not fetched, retrieving then installing.
fetch: Installing https://github.com/miloproductionsinc/cordova-plugin-ionic-webview.git to S:\Projects\MiloProductions\hello
Running command: npm install https://github.com/miloproductionsinc/cordova-plugin-ionic-webview.git --production --save

Information

Interestingly, this does produce the desired result:

<dependency id="cordova-plugin-ionic-webview" url="https://github.com/miloproductionsinc/cordova-plugin-ionic-webview.git#2.x-custom" />

Environment, Platform, Device

windows building android
mac building ios

Version information

cordova 9.0.0
cordova-lib 9.0.1

Any plugin with this type of dependancy should demonstrate this problem, but in this case, my examples are retrieving:

Checklist

• I searched for existing GitHub issues
• I updated all Cordova tooling to most recent version
• I included all the necessary information above

[Chuckytuh]

I was about to open a bug on cordova-fetch with this exact same behaviour but wasn't entirely sure if it should be opened there or here, on cordova-lib. Anyway, I'll just use this issue and expand with my findings on the situation, hopefully it will help understand the real root of the problem.

As reported here, there's a mismatch between the public documentation and the behaviour experienced when installing a cordova plugin that in turn depends on another plugin and specified the commit attribute.

https://github.com/apache/cordova-lib/blob/rel/10.0.0/src/plugman/install.js#L306 : Here the model representing the dependency contains all the correct information as obtained from PluginInfo, namely, URL, ID, git_ref, etc, they are all correctly parsed. Example:

{
    "id": "cordova-plugin-secure-storage",
    "version": "",
    "url": "<https://github.com/OutSystems/cordova-plugin-secure-storage.git>",
    "subdir": "",
    "commit": "2.6.8-OS5",
    "git_ref": "2.6.8-OS5",
    "install_dir": "/Users/calcifer/Development/tmp/test-plugin-dependency/myapp/plugins/cordova-plugin-secure-storage"
}

In fact, this is the value of dep, the input argument for installDependency but internally it does

cordova-lib/src/plugman/install.js

Lines 545 to 546 in 9fd7354

	var dep_src = dep.url.length ? dep.url : (dep.version ? dep.id + '@' + dep.version : dep.id);
	return possiblyFetch(dep_src, install.plugins_dir, opts)

which ends up executing possiblyFetch where the "id" argument receives the value of the URL alone. In turn, possiblyFetch ends up executing cordova-fetch by providing only the following inputs:

> target
"https://github.com/OutSystems/cordova-plugin-secure-storage.git"
> dest
"/Users/calcifer/Development/tmp/test-plugin-dependency/myapp"
> opts
{
    "cli_variables": {},
    "save": true,
    "searchpath": [],
    "link": false,
    "pluginInfoProvider": {
        ...
    },
    "usePlatformWww": true,
    "force": false,
    "save_exact": false,
    "production": true,
    "is_top_level": false,
    "graph": {
        ...
    },
    "platformVersion": "9.0.0",
    "subdir": ".",
    "git_ref": "2.6.8-OS5",
    "expected_id": "cordova-plugin-secure-storage",
    "client": "plugman"
}

As we can see, git_ref property is correctly set, however, cordova-fetch does nothing with that information and just ends up calling npm install with the provided URL alone.

This is why I wasn't sure if this is a bug here or on cordova-fetch.

This is replicable on cordova-cli 10.0.0.